Detections
Analytics
Alpine: openvpn: security update to 0
critical Tenable Self-Hosted Container Security Plugin ID 406177
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- The Aviatrix OpenVPN client through 2.5.7 on Linux, macOS, and Windows is vulnerable when OpenSSL
parameters are altered from the issued value set; the parameters could allow unauthorized third-party
libraries to load. (CVE-2020-7224)
- Arbitrary File Write exists in Aviatrix VPN Client 2.8.2 and earlier. The VPN service writes logs to a
location that is world writable and can be leveraged to gain write access to any file on the system.
(CVE-2020-27569)
- OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a
named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privileges
(CVE-2024-4877)
See Also
https://security.alpinelinux.org/vuln/CVE-2020-7224
Plugin Details
Severity: Critical
ID: 406177
Version: Revision 1.36
Type: Local
Published: 10/31/2023
Updated: 8/6/2025
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2020-7224
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 4/16/2020