CVEvulnerability

CVE-2013-2061

2.6 LOW Published 2013-11-18 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2013-11-18
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
2.6 LOW — AV:N/AC:H/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200

Description

The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.

Affected configurations

• openvpn openvpn (<= 2.3.0) • openvpn openvpn 1.2.0 • openvpn openvpn 1.2.1 • openvpn openvpn 1.3.0 • openvpn openvpn 1.3.1 • openvpn openvpn 1.3.2 • openvpn openvpn 1.4.0 • openvpn openvpn 1.4.1 • openvpn openvpn 1.4.2 • openvpn openvpn 1.4.3 • openvpn openvpn 1.5.0 • openvpn openvpn 1.6.0 • openvpn openvpn 2.1.0 • openvpn openvpn 2.2.0 • openvpn openvpn access server 2.0.0 • opensuse opensuse 11.4

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References