[ GLSA 201311-13 ] OpenVPN: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: OpenVPN: Multiple vulnerabilities (GLSA 201311-13)
Severity: normal
Exploitable: remote
Date: November 20, 2013
Bug(s): #293894, #468756
ID: 201311-13

Synopsis

Multiple vulnerabilities have been found in OpenVPN, allowing
remote attackers to read encrypted traffic.


Background

OpenVPN is a multi-platform, full-featured SSL VPN solution.

Affected Packages

Package: net-misc/openvpn
Vulnerable: < 2.3.1
Unaffected: >= 2.3.1
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in OpenVPN. Please review
the CVE identifiers referenced below for details.


Impact

A remote attacker may be able to recover plaintext from an encrypted
communication. Another vulnerability could allow remote attacker perform
a Man-in-the-Middle attack.


Workaround

There is no known workaround at this time.

Resolution

All OpenVPN users should upgrade to the latest version: