CVE-2025-3908

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2025-3908

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-3908.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-3908

Downstream

UBUNTU-CVE-2025-3908

Published

2025-05-19T15:15:23Z

Modified

2025-06-12T16:25:23Z

Summary

[none]

Details

The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory.

References

https://community.openvpn.net/Security%20Announcements/CVE-2025-3908
http://www.openwall.com/lists/oss-security/2025/05/20/2
https://security-tracker.debian.org/tracker/CVE-2025-3908

Affected packages

Debian:13 / openvpn3-client

Package

Name: openvpn3-client
Purl: pkg:deb/debian/openvpn3-client?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

24.1+dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}