mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-06-14 05:49:57 +00:00
Meenali Gupta
cfcc9f9945
CVE-2024-24974: Previously, the VPN tool’s Windows implementation allowed remote access to its service pipe, posing a security risk. Using compromised credentials, a threat actor could communicate with OpenVPN to orchestrate attacks. CVE-2024-27903: OpenVPN has mitigated the risk by restricting plugin load. Plugins can now only be loaded from the software’s install directory, the Windows system directory, and the plugin_dir directory under the software’s installation. CVE-2024-27459: This vulnerability affects the interactive service component, potentially leading to local privilege escalation when triggered by an oversized message.To mitigate this risk, the VPN solution now terminates connections upon detecting excessively large messages, preventing stack overflow exploits. References: https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/ https://socradar.io/openvpn-fixed-multiple-vulnerabilities-on-windows/ https://community.openvpn.net/openvpn/wiki/CVE-2024-27903 https://community.openvpn.net/openvpn/wiki/CVE-2024-27459 https://community.openvpn.net/openvpn/wiki/CVE-2024-24974 Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
Collection of layers for the OE-core universe Main layer maintainer: Armin Kuster <akuster808@gmail.com> This repository is a collection of layers to suppliment OE-Core with additional packages, Each layer have designated maintainer Please see the respective READMEs in the layer subdirectories