CVE-2024-8474

OpenVPN / OpenVPN Connect PUBLISHED

Description (CNA)

OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic

Affected (CNA)

Vendor / product	Versions
OpenVPN / OpenVPN Connect	affected 0 through 3.5.0

CWE

CWE-212

References

https://openvpn.net/connect-docs/android-release-notes.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.