list-openvpn-nl

list-openvpn-nl@lists.fox-it.com

37 discussions

OpenVPN-NL 2.4.12-nl1 released
by Max Fillinger 14 Apr '22

14 Apr '22

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 A new version of OpenVPN-NL (2.4.12-nl1) is available on the OpenVPN-NL website [1]. This version is based on OpenVPN 2.4.12 [2], and mbed TLS 2.16.2 [3]. This release fixes CVE-2022-0547 [4]. OpenVPN 2.4.12 now aborts when there are multiple authentication plugins that are attempting deferred authentication. In earlier versions of OpenVPN, this situation could lead to a potential authentication bypass if one of the plugins accepts the user, but another one does not. Apart from that, it contains several bugfixes and improvements. The Windows installer is now signed with a new key because the old one expired. You can find the new certificate at [5]. Version 2.4.9-nl1 is now deprecated. References - ------------ [1] https://openvpn.fox-it.com/ [2] https://github.com/OpenVPN/openvpn/blob/v2.4.12/Changes.rst [3] https://tls.mbed.org/tech-updates/releases/mbedtls-2.16.2-and-2.7.11-releas… [4] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0547 [5] https://openvpn.fox-it.com/repos/fox-crypto-win-2021.pem -----BEGIN PGP SIGNATURE----- iQHXBAEBCABBFiEEXj3Vjj5AbsDlPfHO5IsYow7qaagFAmJYOQAjHG1heGltaWxp YW4uZmlsbGluZ2VyQGZveGNyeXB0by5jb20ACgkQ5IsYow7qaagIbwv/UPjup8SX ISdGdZjCy702P/jaVCeLg2k8uUdrM8RmPTqF5jptmKWVxb4sIXAwL3LnLmBw3MtN /26Y3eEoxYLR64JfEkYqvgXerX84E2R3AB7tji8d+V0EVX694kqI/P3xXoB5UPpT heEfZLVlJ7A9jiNJ1nyz4om3AHmOm12HfVeLUwZmekcgF6ump/abpPeCfxF3SRPC DmaMJ9JxjRsC3YXvzbT5htizCOQBW+1AF4/+pP3P50jwDsxqG5L2aqprnuC1damP kvE4Ko7ZOdyqFL9pwlCxvogA9zLQPSMzMWyXMyi7TDju3rWumZtb90b0t4SK8KGl 4wFa9anDLluVrxz+bfky5kCXw+lCodoQQWAoL93/oYzm2PMQOBenqsDGdMOq/wOO S/S76pWMqde28JAfkdBz9tfokANho3bUclMhHD1dI93TGaV55BZmVVlv/zuO6e4Y 8sPed0LCxe2w4k1dYBDrCsaXAqmosxBXl5U60Jij99D6NaA9tNLibjaz =2ajQ -----END PGP SIGNATURE-----

1 0

CVE-2022-0547: Possible auth-bypass when using multiple deferred-auth plugins
by Max Fillinger 18 Mar '22

18 Mar '22

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 A potential authentication bypass vulnerability has been reported in OpenVPN. This vulnerability was assigned CVE-2022-0547. All versions of OpenVPN-NL 2.4.x are affected as well. When using multiple deferred authentication plugins in an OpenVPN server, it can happen that a user is admitted even if one of the plugins rejects them. This bug can be avoided by running at most one deferred authentication plugin. There is no issue using multiple non-deferred authentication plugins. Link to the announcement at openvpn.net: https://community.openvpn.net/openvpn/wiki/CVE-2022-0547 Best regards, Max Fillinger -----BEGIN PGP SIGNATURE----- iQHXBAEBCABBFiEEXj3Vjj5AbsDlPfHO5IsYow7qaagFAmI07WgjHG1heGltaWxp YW4uZmlsbGluZ2VyQGZveGNyeXB0by5jb20ACgkQ5IsYow7qaaj8TQv/SwbhiidG rriwOpZASgu8jrj9dD7pdslBx9y4iUyqvYhn68mi3J/+9U3TKAvJc/QG/VSpUjzH Q32YRFh8myY7bUrUMsr3w9clJVr94P+yq9VemfXSyMa0cnem+ifLDE0CSOt8Pj6X nBhYHy/72P4ZEx1+ycrJvGruNgGGcSo40u00KMoclrDdfaOemofWjjGTF6UcNGh7 a9XysNhc8ylRODjH0t+Q4oM8BkjKgoX89B/2+f33R0Zv6c7LLGf4ghYGfxQ4LfNy DPpeONTArOe9Dh1GZcGMCo0gbAiLMMbI7YOVETKiK9uTQCMi2JdoIerBU9kbx/7q wi0n+iWKT1ptHlzl8t3UVjJTif4nzRdeaRzpiRwDfY0mF/+Ig2luhzcizLlMaZj8 piD8HvtdPFLOUN7+Ff+Xw27GN021Rg7Uy2NC95dpDFKvSUTWKd8e5x+qH/KXzII/ LGL4WHczDjmjaxUduDb6CR5Z2cQgNdFqG8cm1KWSuFdiMGq0zLzREyVp =wAlk -----END PGP SIGNATURE-----

1 0

OpenVPN-NL 2.3.9-nl4 untrusted
by Max Fillinger 14 Jun '21

14 Jun '21

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Version 2.3.9-nl4 of OpenVPN-NL is now considered untrusted due to its age. We do not know of any specific vulnerabilities. We recommend to replace it with the current version 2.4.9-nl1. It was marked as untrusted when we released 2.4.9-nl1. I apologize for forgetting to send out the announcement then. -----BEGIN PGP SIGNATURE----- iQGzBAEBCAAdFiEEG9gXxeekKy1t135fT0WOFWw/+OQFAmDHhsgACgkQT0WOFWw/ +ORTOAv+Pe0lL2iQuH/cb2zryRoM3V84u1zyAYYOyn5p0/fiy5FiAtKISz8MRfDf OYuA3MkQd1PyWb3RDK3bud+4g7jyJWW36LafRpuu05UL23D6gMyAeCZERHx9mBSP cbM+aIPTqZKZZCoSjBTOnySY5pDFoYDXN1WQKpFMQEV5cy07FY5TKdzLf9XPIWtU IX1sG33/vMBAvIS+t+GpIyhcAC1wFhHB5wjri09dA+0id0BDQdVcDk85X9RRauBX KTnWd07VEAvUmT26WsACGWM2uxM/D77gUFuFL2DezeobK744XV+adbBxX0fT7bYK CKx6YX/8ErcCuvs1hAJTx5sJ0q3d6j3gNOWHz5I419JNeMbDSBPc3aYqw8geE8CC Y9w7tyIWhlu4+v2ma+OlNuPjIaGnL6KoLC2TLsUu2MPOdcDGNSeNdLbu+A6VBWc+ hRO7DXEmDQ/aSSR+3n1DCnw3sRvs/3QspgSNa5JX9soPG7QaIGknG7Hc2uxoCr71 KcnbKe17 =6R/+ -----END PGP SIGNATURE-----

1 0

OpenVPN-NL 2.4.9-nl1 released
by Max Fillinger 01 Apr '21

01 Apr '21

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 A new version of OpenVPN-NL (2.4.9-nl1) is available on the OpenVPN-NL website [1]. This version is based on OpenVPN 2.4.9 [2], and mbed TLS 2.16.2 [3]. This release resolves an issue where OpenVPN-NL might ignore a Certificate Revocation List if it is running in chroot mode. Apart from that, it contains some minor bugfixes and improvements. References - - ---------- [1] https://openvpn.fox-it.com/ [2] https://github.com/OpenVPN/openvpn/blob/v2.4.9/Changes.rst [3] https://tls.mbed.org/tech-updates/releases/mbedtls-2.16.2-and-2.7.11-releas… -----BEGIN PGP SIGNATURE----- iQHXBAEBCABBFiEEXj3Vjj5AbsDlPfHO5IsYow7qaagFAmBl1hojHG1heGltaWxp YW4uZmlsbGluZ2VyQGZveGNyeXB0by5jb20ACgkQ5IsYow7qaagQvQv/blzX47xG 6O9fAO1aeeb3MAzkJv/fCiirj1T3FQsEN3/oApyO5lFqK8mAIzjyWFU8W6IQZbwv hkAgKz6wu6XL0P97/RfKlsjD6ddpBExxaV0slh68iiVEDVKzLWu3N0TTh6YEJBgU yv+1nSF/M2XIMTgzFRVj4e5CCa6Jif3LJclEC1JAM7cFd16FMY+KCNpLnheKndwy jqhrQN5uX1W+bQY5NYUq/0WjLUGak6DqGbljSuftZDRRzjKdfwIUsivmWlV4cvdc kfO2mDlubw6NlAxuEW4EzVH00KGtN45qulUCKUi2hRAitH8jjOlegqPQmCcOD5lq hB4aEB+R22m7AEb6RmxS4s6rLuSxiQqQ4M4TLX1/JQbdhyumIW50/Q7uAESEyS5H RCX9gjumAyuE4kU0SX+cxtz32r9DNLQTQTwhTVPatDMalxISef8Wzey4kyHdEumX OdywBn4reEeCIx99+37Fugtvyg2/77X+/9JrAcH7MJi4QA1ZsdjD066S =4oNV -----END PGP SIGNATURE-----

1 0

OpenVPN-NL 2.4.7-nl1 released
by Steffan Karger 03 Dec '19

03 Dec '19

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 A new version of OpenVPN-NL (2.4.7-nl1) is available on the OpenVPN-NL website [1]. This version is based on OpenVPN 2.4.7 [2], and mbed TLS 2.16.2 [3]. This release resolves an issue where connection setup could hang during authentication when using a PKCS#11 smartcard or token. This release uses a new (Extended Validation) Windows Code signing certificate for the windows installer and binary files. The sha1 fingerprint of this new certificate is: 4E:0B:50:AB:B6:4C:E3:BE:6E:CA:DE:91:B7:2E:54:EC:BC:16:C8:BC The preexisting certificate is still used for tap-windows driver signing. References - ---------- [1] https://openvpn.fox-it.com/ [2] https://github.com/OpenVPN/openvpn/blob/v2.4.7/Changes.rst [3] https://tls.mbed.org/tech-updates/releases/mbedtls-2.16.2-and- 2.7.11-released -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEpoMl4pqcgPPzIMN1QTCd1Y5jXDkFAl3mkhUACgkQQTCd1Y5j XDka8ggAit+RP0sUZnHefbXRTM723MCrRXG9gy7pTpj+UiT3I/obvEY6WBgVb3sg 6KZUiWP1KI64mB8QFnoMLsiYA/lEJ9BYpWFu2deohdJPQ4Gc3bYs4bwvZzrcA2Iy gi+ws+PubihsiNHaIVeDWtaYE1qLvj+PpTQKWHI+KIxYX2NpV7fdaU8r4/XYujHz bbSbeJceuaG5mUKVeBGlN9bfp7rtN3kVz/DZaAn6z49TNqVHSj8fbHNgxVCUUASQ y2RRir8g0AH6X7gY3x9uvyrCkdt5HZ4H6fHGE0HYWKaCjPMcP4QKc10IRwYaz+YR wAZhhbyXuMC4ol//3O4FMUYzFJR6ng== =lAVq -----END PGP SIGNATURE-----

1 0

Security advisory: mbed TLS CVE-2018-0497 and CVE-2018-0498
by Steffan Karger 13 Aug '18

13 Aug '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Summary: OpenVPN-NL is not vulnerable to the two 'high'-rated security issues in the recently published mbed TLS security advisory [0]. Background: Recently, mbed TLS issued new software versions accompanied by a security advisory containing two 'high'-rated security issues: 1) Remote plaintext recovery on use of CBC-based cipher suites through a timing side-channel Researchers showed that the mitigations for the lucky13 attack implemented by mbedtls were not working properly for cipher suites using SHA384 (or SHA512, but those do not exist). This attack applies only when using a TLS cipher suite that combines AES-CBC with SHA384. OpenVPN-NL does not support such a cipher suite, and is therefor not vulnerable. 2) Plaintext recovery on use of CBC-based cipher suites through a cache based side-channel Similar to the above, the implementation of the same cipher suites was also vulnerable to cache-based side-channel attacks. OpenVPN-NL does not support any of the affected cipher suites, and is therefor not vulnerable. [0] https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-a dvisory-2018-02 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJbcaVdAAoJEEEwndWOY1w5t2gH/1RLAaSxQvNuk/DXLJ/20UAd lMi4t21qnFoGIGkYUOVrVuW2qHEH3EJYZD+ioQ+tptAYVwm9j60vsLNStJVPhb+u Qtn0cYcb4npQrF7VFJCDkMNAM8vQU+DZJ30zC/GOuewYi9/s2XoFrwEHIXFG4kCH v4/+R72xEhMF2uJWjZ/ZReBmNM4BRdis+/IV92F7/86BacEuPH8LHSLb90B9gujL L4nJF3kveOH9Tp5rXnoAoEUb47mSCQ5oAe6bf2k8ddxl9k7vIAaOT8jzgJycxbAz CaHLG+WlTKLbpJ+W0xw1FkybkT31HRcpdn9jz9DS1CuHLweKWy8UhUPp3Tt5puQ= =jCKW -----END PGP SIGNATURE-----

1 0

OpenVPN-NL 2.4.6-nl2 released
by Steffan Karger 01 Jun '18

01 Jun '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 A new version of OpenVPN-NL (2.4.6-nl2) is available on the OpenVPN-NL website [1]. This version is based on OpenVPN 2.4.6 [2], and mbed TLS 2.9.0 [3]. This release resolves several security issues: 1) CVE-2018-9336: fix potential double-free() in the Windows Interactive Service A local attacker could send malformed input data on the service pipe towards the OpenVPN interactive service, which can result in a double free() in the error handling code. This usually only leads to a process crash (DoS by an unprivileged local account) but it could lead to memory corruption and potentially privilege escalation if happening while multiple other threads are active at the same time. This only affects users that run the interactive service on Windows. 2) Out-of-bounds read in the tap-windows driver This allows a local attacker that is able to send invalid ICMPv6 packets from the local machine to the local tap-windows adapter to crash the local machine (BSOD). The overread data is not leaked to the attacker or peer. 3) Several bugfixes in mbed TLS mbed TLS 2.8 fixed a number of denial-of-service bugs [4]. mbed TLS 2.9 fixed a number of parsing bugs, which have no or very limited impact on OpenVPN-NL, because most of the affected components are disabled, and the strict set of allowed ciphers prevents selecting an insecure cipher. Furthermore, the usage of tls-auth or tls-crypt prevents an attacker without the tls-auth/tls-crypt key from executing an attack. This release uses a new (Extended Validation) Windows Code signing certificate for the tap-windows driver files. The sha1 fingerprint of this new certificate is: 27:FA:AB:56:C8:F3:52:FD:E8:2F:4E:E7:B0:81:52:4B:DD:94:28:91 The preexisting certificate is still used for non-kernel mode signing, such as the installers and openvpn(serv).exe binaries. References - ---------- [1] https://openvpn.fox-it.com/ [2] https://github.com/OpenVPN/openvpn/blob/v2.4.6/Changes.rst [3] https://tls.mbed.org/tech-updates/releases/mbedtls-2.9.0-2.7.3-and-2.1.1 2-released [4] https://tls.mbed.org/tech-updates/releases/mbedtls-2.8.0-2.7.2-and-2.1.1 1-released -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJbEUKsAAoJEEEwndWOY1w5dkwH/2b8uAaNG2/re0z2PN+QgTWc 7DhP17geYtrcOs16b/KvhnqSGx8GqaC/1Zyj6TYoLEU4sYATuzZGUmTEt/gji+0w WlXc9lz8YIdaD37gyGtyR5Ka5hREL6WLARX6jwCos4B6ziYcncumxkH4yHeSD/pI PdDZKJdVGYrpiDNUcg9LUyIbshOGv36RJ966uFVbSHpLekHdEXwCF+giae3Bxisa QQJREEQzYPqKRWyxggUg9kPU0ofPyT6+BAGtOVqW2uW/HX1J2AdyygC1abPWbFUA 66ZqtcXiYxNw0ykx9ZeoKvi7Y7l1Kkkt6r8XigYII8ztmCze/lHBhNYD0cc7sV0= =i4Tf -----END PGP SIGNATURE-----

1 0

OpenVPN-NL 2.4.4-nl1 released
by Steffan Karger 15 Nov '17

15 Nov '17

A new version of OpenVPN-NL (2.4.4-nl1) is available on the OpenVPN-NL website [1]. This version is based on OpenVPN 2.4.4 [2], and mbed TLS 2.6.0 [3]. This release does not fix any imminent security issues, but does further tighten overall security. Users are advised to upgrade to OpenVPN-NL 2.4.4-nl1 at any convenient time. OpenVPN-NL 2.4 comes with a number of new features. Most of these are equal to the new features in upstream OpenVPN 2.4, see [4] for details. For OpenVPN-NL specifically, we'd like to highlight a few: New ciphers: The control channel now support the following cipher suites by default: TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 TLS-DHE-RSA-WITH-AES-256-CBC-SHA256 The --tls-cipher option allows to also include the backwards-compatibility cipher suite: TLS-DHE-RSA-WITH-AES-256-CBC-SHA The data channel now supports both --cipher AES-256-CBC + --auth SHA256 (like 2.3 did), and --cipher AES-256-GCM (which doesn't need --auth). Data channel cipher negotiation: Negotiable Cipher Parameters (NCP) allows users to upgrade from the previous OpenVPN-NL data channel cipher (AES-256-CBC + HMAC-SHA256) to the new data channel cipher (AES-256-GCM) without running multiple server instances. The new cipher has better performance and a lower per-packet overhead. If NCP is enabled at both ends, AES-256-GCM is automatically negotiated. In OpenVPN-NL 2.4, NCP is enabled by default on client instances, but disabled by default on server instances to allow server administrators to have full control over the cipher upgrade. NCP can be enabled using the --ncp-enable option. Control channel encryption: The new --tls-crypt option can be used instead of --tls-auth, to both encrypt and authenticate control channel packets. This hides the TLS certificate contents from attackers without the --tls-crypt key. Better support for roaming clients: UDP mode now supports client IP/port changes without requiring a reconnect. This reduces the need for clients to reconnect often, improving connection stability and reducing server load. Stricter CRL checking: The CRL verification implementation now verifies that the CRL is correctly signed by the CA, and interprets the CRL 'nextUpdate' field as an expiration date. If the CRL is expired, connections will be rejected. Stricter config file checking: Unused parameters to config options are no longer silently ignored. Instead, such configs are now rejected on startup. For more details, please refer to the upstream Changes document on [4]. References ---------- [1] https://openvpn.fox-it.com/ [2] https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24 [3] https://tls.mbed.org/tech-updates/releases/mbedtls-2.6.0-2.1.9-and-1.3.21-r… [4] https://github.com/OpenVPN/openvpn/blob/v2.4.4/Changes.rst

1 1

OpenVPN-NL 2.3.9-nl4 released
by Gert van Dijk 22 Sep '17

22 Sep '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 A new version of OpenVPN-NL (2.3.9-nl4) is available on the OpenVPN-NL website [1]. This version is based on OpenVPN 2.3.9 [2], and PolarSSL 1.2.19 [3]. This release of OpenVPN-NL removes the 'key-method 1' key exchange. OpenVPN-NL has always used 'key-method 2' as its default, and this only affects users that previously explicitly set 'key-method 1' in their configuration. Key-method 1 is removed, because a buffer overwrite security issue was discovered [4]. Since key-method 1 is not needed and inferior to key-method 2, OpenVPN-NL decided to remove the functionality to eliminate the vulnerability and reduce attack surface. Users are advised to refrain from using 'key-method 1'. Users that do not use 'key-method 1' can upgrade to OpenVPN-NL 2.3.9-nl4 at any convenient time. As of this release, OpenVPN-NL is also available for Debian Stretch. References - ---------- [1] https://openvpn.fox-it.com/ [2] https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23 [3] https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-an d-polarssl.1.2.19-released [4] https://community.openvpn.net/openvpn/wiki/CVE-2017-12166 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQIcBAEBCgAGBQJZxQGuAAoJEOK/pu29oZxvq1kP/jlaJvgx3+u/62BrhktqLflA RG0RUlztpk8j2UStxT6etTNPIYgQMalRpZk9Gf/GJnjMAeSkUQQGMVbazpNokAT+ AZr6FBZmbzwgjSvLhn1WSMfktWIiWYV7gjhpDRqO/kgwrCGJqVArCYGdwVEqTZGK pTeZkRHlL37WzKA+W4RnubUtakPsp9qsbz6aporACeQa00OGRR8+KJA8p7dzlfj5 r+YgPv5L0G5rdjUWfUTp0llvb+Gb2l4cVrfYbVkYtbHw78WpTCREF9L1NqSSkj5Z qjJ4PzR1q/tSLioOpUN34Et+1+dzkMk4CySnLhURW2H7XAwf0nLXYpALE+XJJTIi EU80Id9zjBByDb5wGspQt4jMu8WEtqunTT8RM69avSxJEJrLDThrXwYiMorRRAtY 966Dwrv63DhAT2YPG4W4PuEzUqIl+uEtpV6O5/Uyi2MVG+9A4aG217es/pzm0eHv P+1U6YykP3OEi1pGDtF60g4h3eongoqTuI1czhzjTG2eWHzQdBDeqC3g3kIwuriw wt5U1R2JRiza+u1ex/BgbNH6gMR3lNftcgD0X5h6s+CEb2FoxwSWgTRkpiFFhw+D AOCsCqJ+KR6jF+Up3XZokwpIGwD6EnyrwoEvcwswFcIBYgw4Z1fptzqIhgRlu28a OO/K0GYa+kBMjbFqavu9 =4yET -----END PGP SIGNATURE-----

1 0

OpenVPN-NL 2.3.9-nl3 released
by Steffan Karger 21 Jun '17

21 Jun '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 A new version of OpenVPN-NL (2.3.9-nl3) is available on the OpenVPN-NL website [1]. This version is based on OpenVPN 2.3.9 [2], and PolarSSL 1.2.19 [3]. This new version of OpenVPN-NL includes two security fixes: 1) Post-authentication client-to-server denial-of-service A fully authenticated client can send a specially crafted packet to the OpenVPN server, causing the server to crash. An attacker needs a valid certificate, and - if it is in use - a valid tls-auth key to mount this attack. Only servers that have enabled IPv6 inside the tunnel are affected (e.g. through the --server-ipv6, - --ifconfig-ipv6-pool, --ifconfig-ipv6-push or --iroute-ipv6 options). 2) Pre-authentication remote crash/information disclosure for clients If clients use a HTTP proxy with NTLM authentication (i.e. "--http-proxy <server> <port> [<authfile>|'auto'|'auto-nct'] ntlm2"), a man-in-the-middle attacker between the client and the proxy can cause the client to crash or disclose at most 96 bytes of stack memory. The disclosed stack memory is likely to contain the proxy password. If the proxy password is not reused, this is unlikely to compromise the security of the OpenVPN tunnel itself. Clients who do not use the --http-proxy option with ntlm2 authentication are not affected. This release removes the --http-proxy NTLM authentication methods to remove the vulnerability. NTLM authentication will be re-added once we have regained confidence in the quality of the NTLM authentication module code. Furthermore, this release force-disables MD5 digests for certificates. This is a hardening measure that prevents accidental misconfiguration where the Certificate Authority may issue certificates with MD5 digests. Users are advised to upgrade all OpenVPN-NL servers to 2.3.9-nl3, and upgrade clients if the vulnerable HTTP proxy with ntlm2 authentication is used. More information on the vulnerabilities can be found at [4]. References - ---------- [1] https://openvpn.fox-it.com/ [2] https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23 [3] https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-an d-polarssl.1.2.19-released [4] https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN 243 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJZSlvzAAoJEEEwndWOY1w57AwH/iMrL5rKp+qazbZspfyTFZwq 7RGhWQoML/QpHQeycznQ7zb+b7YXYb/JWFoW95s2VisDeZDv63oDB7QxhqpMW7je dXdmxV3TM1xW1exjd86EP2eTNG6/80z4ZDJg1rTP3aXPPwBWL77UHKLVTeL49PxK SjhY+kPhVj9tjgPxYZzQa88R8X34JoLVKo0OhcciyJ48Pk2/6NJnI+rKf5EB337f bEyPVqat7I4IcPWgTOYurx0V2ljrVJN7xlIj7lm2J4phzuTffl1NC4iUbmYgGBnD bS7H92wqe2MxZts54QcFVDEKZpiv444qbHoc7vrocSM9BBeZfwOidaRyA0TCG/Q= =PhV3 -----END PGP SIGNATURE-----

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

list-openvpn-nl