CVE-2025-3908 - OpenVPN 3 Linux, openvpn3-admin init-config follows symlink

The OpenVPN 3 Linux v20 introduced a new command, openvpn3-admin init-config, to help getting an initial base configuration adopted to the currently running host. This command must be run as root.

It was discovered that this tool will follow symlinks when changing ownership and permissions on two of the directories the OpenVPN 3 Linux D-Bus services depends on.

All versions from v20 through v24 are affected. This has been resolved in OpenVPN 3 Linux v24.1.

https://www.cve.org/CVERecord?id=CVE-2025-3908

Reported by: Wolfgang Frisch, SUSE Security team