FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-04-29 10:45:39 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
8604121c-7fc2-11ea-bcac-7781e90b0c8f	openvpn -- illegal client float can break VPN session for other users Lev Stipakov and Gert Doering report: There is a time frame between allocating peer-id and initializing data channel key (which is performed on receiving push request or on async push-reply) in which the existing peer-id float checks do not work right. If a "rogue" data channel packet arrives during that time frame from another address and with same peer-id, this would cause client to float to that new address. The net effect of this behaviour is that the VPN session for the "victim client" is broken. Since the "attacker client" does not have suitable keys, it can not inject or steal VPN traffic from the other session. The time window is small and it can not be used to attack a specific client's session, unless some other way is found to make it disconnect and reconnect first. Discovery 2020-04-13 Entry 2020-04-16 openvpn < 2.4.8_3 openvpn-mbedtls < 2.4.8_3 openvpn-devel < 202016 https://github.com/OpenVPN/openvpn/commit/f7b318f811bb43c0d3aa7f337ec6242ed2c33881 https://sourceforge.net/p/openvpn/openvpn/ci/f7b318f811bb43c0d3aa7f337ec6242ed2c33881/ https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19720.html https://community.openvpn.net/openvpn/ticket/1272 https://patchwork.openvpn.net/patch/1077/ CVE-2020-11810
2fe004f5-83fd-11ee-9f5d-31909fb2f495	openvpn -- 2.6.0...2.6.6 --fragment option division by zero crash, and TLS data leak The OpenVPN community project team reports: CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly restore "--fragment" configuration in some circumstances, leading to a division by zero when "--fragment" is used. On platforms where division by zero is fatal, this will cause an OpenVPN crash. Reported by Niccolo Belli and WIPocket (Github #400, #417). CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly use a send buffer after it has been free()d in some circumstances, causing some free()d memory to be sent to the peer. All configurations using TLS (e.g. not using --secret) are affected by this issue. (found while tracking down CVE-2023-46849 / Github #400, #417) Discovery 2023-08-29 Entry 2023-11-15 Modified 2023-12-31 openvpn ge 2.6.0 lt 2.6.7_1 openvpn-devel < g20231109,1 CVE-2023-46849 CVE-2023-46850 https://github.com/OpenVPN/openvpn/blob/v2.6.7/Changes.rst#overview-of-changes-in-267

VuXML ID

Description

8604121c-7fc2-11ea-bcac-7781e90b0c8f

openvpn -- illegal client float can break VPN session for other users

Lev Stipakov and Gert Doering report:

There is a time frame between allocating peer-id and initializing data channel key (which is performed on receiving push request or on async push-reply) in which the existing peer-id float checks do not work right.

If a "rogue" data channel packet arrives during that time frame from another address and with same peer-id, this would cause client to float to that new address.

The net effect of this behaviour is that the VPN session for the "victim client" is broken. Since the "attacker client" does not have suitable keys, it can not inject or steal VPN traffic from the other session. The time window is small and it can not be used to attack a specific client's session, unless some other way is found to make it disconnect and reconnect first.

Discovery 2020-04-13
Entry 2020-04-16
openvpn

< 2.4.8_3

openvpn-mbedtls

< 2.4.8_3

openvpn-devel

< 202016

https://github.com/OpenVPN/openvpn/commit/f7b318f811bb43c0d3aa7f337ec6242ed2c33881
https://sourceforge.net/p/openvpn/openvpn/ci/f7b318f811bb43c0d3aa7f337ec6242ed2c33881/
https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19720.html
https://community.openvpn.net/openvpn/ticket/1272
https://patchwork.openvpn.net/patch/1077/
CVE-2020-11810

2fe004f5-83fd-11ee-9f5d-31909fb2f495

openvpn -- 2.6.0...2.6.6 --fragment option division by zero crash, and TLS data leak

The OpenVPN community project team reports:

CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly restore "--fragment" configuration in some circumstances, leading to a division by zero when "--fragment" is used. On platforms where division by zero is fatal, this will cause an OpenVPN crash.

Reported by Niccolo Belli and WIPocket (Github #400, #417).

CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly use a send buffer after it has been free()d in some circumstances, causing some free()d memory to be sent to the peer. All configurations using TLS (e.g. not using --secret) are affected by this issue. (found while tracking down CVE-2023-46849 / Github #400, #417)

Discovery 2023-08-29
Entry 2023-11-15
Modified 2023-12-31
openvpn

ge 2.6.0 lt 2.6.7_1

openvpn-devel

< g20231109,1

CVE-2023-46849
CVE-2023-46850
https://github.com/OpenVPN/openvpn/blob/v2.6.7/Changes.rst#overview-of-changes-in-267