Total vulnerabilities in the database
The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.
| Software | From | Fixed in |
|---|---|---|
| openvpn / openvpn | 1.5.0 | 1.5.0.x |
| openvpn / openvpn | 1.4.0 | 1.4.0.x |
| openvpn / openvpn | 1.3.0 | 1.3.0.x |
| openvpn / openvpn | 1.6.0 | 1.6.0.x |
| openvpn / openvpn | 1.3.1 | 1.3.1.x |
| openvpn / openvpn | 1.4.1 | 1.4.1.x |
| openvpn / openvpn | 1.2.1 | 1.2.1.x |
| openvpn / openvpn | 1.3.2 | 1.3.2.x |
| openvpn / openvpn | 2.1.0 | 2.1.0.x |
| openvpn / openvpn | 1.2.0 | 1.2.0.x |
| openvpn / openvpn | 1.4.3 | 1.4.3.x |
| openvpn / openvpn | 2.2.0 | 2.2.0.x |
| openvpn / openvpn | - | 2.3.0.x |
| openvpn / openvpn | 1.4.2 | 1.4.2.x |
| openvpn / openvpn_access_server | 2.0.0 | 2.0.0.x |
| opensuse / opensuse | 11.4 | 11.4.x |