[<prev] [next>] [day] [month] [year] [list]
Message-ID: <3a86b9b8-ec83-41c6-8900-395712914eab@eurephia.org>
Date: Wed, 2 Apr 2025 23:36:41 +0200
From: David Sommerseth <dazo@...ephia.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-2704 - OpenVPN 2.6.1 through 2.6.13 with possible DoS
The OpenVPN community has released OpenVPN 2.6.14 which includes a
critical security fix.
This issue is fixed in OpenVPN 2.6.14 which has been released today.
-----------------------------------------------------------------
CVE-2025-2704: Fix possible ASSERT() on OpenVPN servers
using --tls-crypt-v2
OpenVPN servers between 2.6.1 and 2.6.13 using --tls-crypt-v2 can be
made to abort with an ASSERT() message by sending a particular
combination of authenticated and malformed packets.
To trigger the bug, a valid tls-crypt-v2 client key is needed, or
network observation of a handshake with a valid tls-crypt-v2 client key.
No crypto integrity is violated, no data is leaked, and no remote code
execution is possible. This bug does not affect OpenVPN clients.
(Bug found by internal QA at OpenVPN Inc)
-----------------------------------------------------------------
<https://community.openvpn.net/openvpn/wiki/Downloads#OpenVPN2.6.14--Released02April2025>
<https://community.openvpn.net/openvpn/wiki/CVE-2025-2704>
<https://www.cve.org/CVERecord?id=CVE-2025-2704>
--
kind regards,
David Sommerseth
OpenVPN Inc
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
