Vulnerability Database

300,445

Total vulnerabilities in the database

CVE-2013-2061

The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.

  • Published: Nov 18, 2013
  • Updated: Nov 9, 2025
  • CVE: CVE-2013-2061
  • Severity: Low
  • Exploit:

CVSS v2:

  • Severity: Low
  • Score: 2.6
  • AV:N/AC:H/Au:N/C:P/I:N/A:N

CWEs:

Software From Fixed in
openvpn / openvpn 1.5.0 1.5.0.x
openvpn / openvpn 1.4.0 1.4.0.x
openvpn / openvpn 1.3.0 1.3.0.x
openvpn / openvpn 1.6.0 1.6.0.x
openvpn / openvpn 1.3.1 1.3.1.x
openvpn / openvpn 1.4.1 1.4.1.x
openvpn / openvpn 1.2.1 1.2.1.x
openvpn / openvpn 1.3.2 1.3.2.x
openvpn / openvpn 2.1.0 2.1.0.x
openvpn / openvpn 1.2.0 1.2.0.x
openvpn / openvpn 1.4.3 1.4.3.x
openvpn / openvpn 2.2.0 2.2.0.x
openvpn / openvpn - 2.3.0.x
openvpn / openvpn 1.4.2 1.4.2.x
openvpn / openvpn_access_server 2.0.0 2.0.0.x
opensuse / opensuse 11.4 11.4.x