Symlink Vulnerability in OpenVPN3 Client: Local Attack Risk
Summary
DEBIAN-CVE-2025-3908: The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destina... Affects openvpn3-client versions < 24.1+dfsg-1. Fixed in 24.1+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenVPN3 Client is a widely used open-source software that provides secure point-to-point or site-to-site connections in routed or bridged configurations. It is known for its flexibility and strong encryption capabilities. However, versions 20 through 24 of OpenVPN3 Client on Linux have a critical vulnerability that allows local attackers to exploit symlinks, potentially compromising system directories.
Vulnerability Detail
The vulnerability arises from the configuration initialization tool in OpenVPN 3 Linux, which is susceptible to symlink attacks. A local attacker can create symlinks pointing to arbitrary directories, leading to unauthorized changes in ownership and permissions of those directories. This could allow attackers to manipulate sensitive files or escalate privileges, posing significant security risks.
How To Fix
Minimum fixed version
24.1+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade openvpn3-clientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that only trusted users have access to the system and monitor for any suspicious symlink creations. Additionally, consider implementing stricter permissions on sensitive directories to mitigate potential exploitation.
Conclusion
The OpenVPN3 Client vulnerability allows local attackers to exploit symlinks, posing serious security risks. It is crucial to update to the patched version to mitigate these risks. Users should also consider implementing workarounds until they can apply the update.
See every vulnerability recorded for openvpn3-client →
FAQ
Versions 20 through 24 of OpenVPN3 Client on Linux are affected by this vulnerability.
A local attacker can exploit this vulnerability to change ownership and permissions of arbitrary directories, potentially leading to unauthorized access or privilege escalation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, a patch is available in version 24.1+dfsg-1 of the OpenVPN3 Client.
If you cannot update immediately, implement stricter permissions on sensitive directories and limit access to trusted users as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for openvpn3-client.
