FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2025-11-21 11:10:32 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
2cad4541-0f5b-11f0-89f8-411aefea0df9openvpn -- server-side denial-of-service vulnerability with tls-crypt-v2

Gert Doering reports:

OpenVPN servers between 2.6.1 and 2.6.13 using --tls-crypt-v2 can be made to abort with an ASSERT() message by sending a particular combination of authenticated and malformed packets.

To trigger the bug, a valid tls-crypt-v2 client key is needed, or network observation of a handshake with a valid tls-crypt-v2 client key

No crypto integrity is violated, no data is leaked, and no remote code execution is possible.

This bug does not affect OpenVPN clients.


Discovery 2025-03-26
Entry 2025-04-02
openvpn
>= 2.6.1 lt 2.6.14

openvpn-devel
< g20250402,1

CVE-2025-2704
https://github.com/OpenVPN/openvpn/blob/v2.6.14/Changes.rst#overview-of-changes-in-2614
17a40d76-c3fd-11f0-b513-0da7be77c170OpenVPN -- HMAC verification on source IP address ineffective

Arne Schwabe reports:

Fix memcmp check for the hmac verification in the 3way handshake being inverted This is a stupid mistake but causes all hmac cookies to be accepted, thus breaking source IP address validation. As a consequence, TLS sessions can be openend and state can be consumed in the server from IP addresses that did not initiate an initial connection.

While at it, fix check to only allow [t-2;t] timeslots, disallowing HMACs coming in from a future timeslot.


Discovery 2025-10-27
Entry 2025-11-17
openvpn
< 2.6.16

openvpn-devel
< g20251117,1

CVE-2025-13086
https://github.com/OpenVPN/openvpn/commit/fa6a1824b0f37bff137204156a74ca28cf5b6f83