CVE-2013-2061

The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a…

published November 15, 2013

CVSS
—
EPSS
3%
Percentile
86.4
In the wild
Unconfirmed
What it is

The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02813 · 86.4th percentile
Published
2013-11-15T18:16Z
EPSS history
Timeline
  • 15 NOV 18:16Z
    The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a…
    cvelistv5