CVE-2013-2061

Fixed in a distro release EPSS 3%

The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.

Published 2013-11-15 · CVE record · OSV

Products: openvpn, openvpn_access_server, opensuse

Distro releases