2.6

CVE-2013-2061

Exploit

The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.

Data is provided by the National Vulnerability Database (NVD)
Openvpn ≫ Openvpn Version <= 2.3.0
Openvpn ≫ Openvpn Version1.2.0
Openvpn ≫ Openvpn Version1.2.1
Openvpn ≫ Openvpn Version1.3.0
Openvpn ≫ Openvpn Version1.3.1
Openvpn ≫ Openvpn Version1.3.2
Openvpn ≫ Openvpn Version1.4.0
Openvpn ≫ Openvpn Version1.4.1
Openvpn ≫ Openvpn Version1.4.2
Openvpn ≫ Openvpn Version1.4.3
Openvpn ≫ Openvpn Version1.5.0
Openvpn ≫ Openvpn Version1.6.0
Openvpn ≫ Openvpn Version2.1.0
Openvpn ≫ Openvpn Version2.2.0
Openvpn ≫ Openvpn Access Server Version2.0.0
Opensuse ≫ Opensuse Version11.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.45% 0.789
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 2.6 4.9 2.9
AV:N/AC:H/Au:N/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.