Commit 957eeb
2025-11-28 20:04:05 uddr: CVE-2025-13751| /dev/null .. Security Announcements/CVE-2025-13751.md | |
| @@ 0,0 1,15 @@ | |
| + | # CVE-2025-13751 - Windows/interactive service: fix erroneous exit on error that could be used by a local Windows users to achieve a local denial-of-service |
| + | |
| + | Windows/interactive service: fix bug where the interactive service would error-exit in certain error conditions instead of just logging the fact and continuing. |
| + | After the error-exit, OpenVPN connections will no longer work until the service is restarted (or the system rebooted). |
| + | This can be triggered by any authenticated local user, and has thus been classified as a "local denial of service" attack. |
| + | |
| + | OpenVPN version 2.6.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 are affected. This is fixed in version 2.6.17 and 2.7_rc3. |
| + | |
| + | CVE Record: [CVE-2025-13751](https://www.cve.org/CVERecord?id=CVE-2025-13751) |
| + | |
| + | Github: [OpenVPN/openvpn-private-issues#95](https://github.com/OpenVPN/openvpn-private-issues/issues/95) |
| + | |
| + | Release notes: [openvpn-2.7_rc3](https://community.openvpn.net/ReleaseHistory#openvpn-27_rc3-released-28-november-2025) [openvpn-2.6.17](https://community.openvpn.net/ReleaseHistory#openvpn-2617-released-28-november-2025) |
| + | |
| + | Reported by: Lev Stipakov <lev@openvpn.net> |