CVE-2021-31605: furlongm openvpn-monitor command injection
7.5
Basic Information
Technical Details
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
openvpn-monitor | pip | <= 1.1.3 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The provided vulnerability information describes command injection via the OpenVPN management interface socket using %0a (newline) characters, but no specific code snippets, commit diffs, or file paths were available in the provided sources. The advisory indicates the vulnerability stems from improper input sanitization when processing data from the management interface, likely in functions handling socket communication or command execution. However, without access to the actual codebase (e.g., functions using os.system
, subprocess
, or socket handlers in the openvpn-monitor
package), we cannot identify specific function names or file paths with high confidence. The vulnerability mechanism is understood (CWE-77), but the lack of code-level details prevents precise function identification.