git: e1b5c9787523 - main - security/vuxml: add openvpn<2.6.14 server DoS vuln
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Wed, 02 Apr 2025 19:33:24 UTC
The branch main has been updated by mandree:
URL: https://cgit.FreeBSD.org/ports/commit/?id=e1b5c9787523a3f99fdaaabf16caef1a4049dbad
commit e1b5c9787523a3f99fdaaabf16caef1a4049dbad
Author: Matthias Andree <mandree@FreeBSD.org>
AuthorDate: 2025-04-02 19:22:24 +0000
Commit: Matthias Andree <mandree@FreeBSD.org>
CommitDate: 2025-04-02 19:22:24 +0000
security/vuxml: add openvpn<2.6.14 server DoS vuln
Security: 2cad4541-0f5b-11f0-89f8-411aefea0df9
Security: CVE-2025-2704
---
security/vuxml/vuln/2025.xml | 37 +++++++++++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml
index 56e73f865ee6..a746776c70c7 100644
--- a/security/vuxml/vuln/2025.xml
+++ b/security/vuxml/vuln/2025.xml
@@ -1,3 +1,40 @@
+ <vuln vid="2cad4541-0f5b-11f0-89f8-411aefea0df9">
+ <topic>openvpn -- server-side denial-of-service vulnerability with tls-crypt-v2</topic>
+ <affects>
+ <package>
+ <name>openvpn</name>
+ <range><ge>2.6.1</ge><lt>2.6.14</lt></range>
+ </package>
+ <package>
+ <name>openvpn-devel</name>
+ <range><lt>g20250402,1</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Gert Doering reports:</p>
+ <blockquote cite="https://github.com/OpenVPN/openvpn/blob/v2.6.14/Changes.rst#overview-of-changes-in-2614">
+ <p>OpenVPN servers between 2.6.1 and 2.6.13 using
+ --tls-crypt-v2 can be made to abort with an ASSERT() message by
+ sending a particular combination of authenticated and malformed packets.</p>
+ <p>To trigger the bug, a valid tls-crypt-v2 client key is needed, or
+ network observation of a handshake with a valid tls-crypt-v2 client key</p>
+ <p>No crypto integrity is violated, no data is leaked, and no remote
+ code execution is possible.</p>
+ <p>This bug does not affect OpenVPN clients.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2025-2704</cvename>
+ <url>https://github.com/OpenVPN/openvpn/blob/v2.6.14/Changes.rst#overview-of-changes-in-2614</url>
+ </references>
+ <dates>
+ <discovery>2025-03-26</discovery>
+ <entry>2025-04-02</entry>
+ </dates>
+ </vuln>
+
<vuln vid="300f86de-0e4d-11f0-ae40-b42e991fc52e">
<topic>gitea -- Multiple vulnerabilities</topic>
<affects>