Page MenuHomeVyOS Platform
Create Task
Maniphest T355

Outstanding CVEs - OpenVPN
Closed, ResolvedPublicBUG
Actions

Description

Here is a list of outstanding CVEs for OpenVPN

https://www.cvedetails.com/cve/CVE-2017-5868/
https://www.cvedetails.com/cve/CVE-2016-6329/
https://www.cvedetails.com/cve/CVE-2017-7478/
https://www.cvedetails.com/cve/CVE-2017-7479/
https://www.cvedetails.com/cve/CVE-2017-7508/
https://www.cvedetails.com/cve/CVE-2017-7520/
https://www.cvedetails.com/cve/CVE-2017-7521/
https://www.cvedetails.com/cve/CVE-2017-7522/

Source: https://forum.vyos.net/showthread.php?tid=27172

Details

Difficulty level
Hard (possibly days)
Version
-
Why the issue appeared?
Will be filled on close

Event Timeline

syncer created this task.Aug 19 2017, 2:34 AM
syncer added a project: openvpn.
syncer triaged this task as High priority.Aug 19 2017, 2:40 AM
higebu added a subscriber: higebu.Aug 20 2017, 12:23 PM

@syncer The version of openvpn in 1.1.7 is 2.1.3. 2.1.3 is not affected by these CVEs. See https://www.cvedetails.com/vulnerability-list/vendor_id-3278/product_id-5768/version_id-176319/Openvpn-Openvpn-2.1.3.html

higebu added a comment.Aug 20 2017, 12:24 PM

CVE-2014-8104 is fixed by this commit: https://github.com/vyos/openvpn/commit/eb42da67b9a971a1cec94e3c65350d2e5dccf096

syncer added a comment.Aug 20 2017, 12:28 PM

Thanks,
will move this to 1.2 project instead

syncer edited projects, added VyOS 1.2 Crux; removed VyOS 1.1.x (1.1.8).Aug 20 2017, 12:28 PM
syncer changed Version from 1.1.7 to -.
syncer mentioned this in Unknown Object (Ponder Answer).Aug 29 2017, 10:44 AM
UnicronNL added subscribers: dmbaturin, UnicronNL.Oct 3 2017, 6:50 PM

@dmbaturin @syncer Where can i find the lithium repo?

pasik added a subscriber: pasik.Oct 27 2017, 10:01 PM
c-po added a subscriber: c-po.Dec 28 2017, 11:54 AM

@UnicronNL lithium branch @ https://github.com/vyos/openvpn

But VyOS 1.2.x uses native Debian OpenVPN package.

cpo@AC1:~$ dpkg --list | grep openvpn
ii  openvpn                          2.3.4-5+deb8u2                    amd64        virtual private network daemon

Debian comments regarding above CVEs:
https://security-tracker.debian.org/tracker/CVE-2017-5868 (NOT-FOR-US)
https://security-tracker.debian.org/tracker/CVE-2016-6329 (https://community.openvpn.net/openvpn/wiki/SWEET32 - This is a generic cryptographic weakness, not a vulnerability in OpenVPN per se)
https://security-tracker.debian.org/tracker/CVE-2017-7478 (fixed)
https://security-tracker.debian.org/tracker/CVE-2017-7479 (fixed)
https://security-tracker.debian.org/tracker/CVE-2017-7508 (fixed)
https://security-tracker.debian.org/tracker/CVE-2017-7520 (fixed)
https://security-tracker.debian.org/tracker/CVE-2017-7521 (fixed)
https://security-tracker.debian.org/tracker/CVE-2017-7522 (fixed)

c-po moved this task from Need Triage to In Progress on the VyOS 1.2 Crux board.Dec 28 2017, 11:54 AM
c-po moved this task from In Progress to Finished on the VyOS 1.2 Crux board.Dec 29 2017, 5:33 PM
syncer closed this task as Resolved.Jan 21 2018, 5:20 PM
syncer claimed this task.
syncer edited projects, added VyOS 1.2 Crux (VyOS 1.2.0-rc1), VyOS-1.2.0-GA; removed VyOS 1.2 Crux.Oct 15 2018, 11:50 PM
syncer moved this task from Needs Triage to Finished on the VyOS 1.2 Crux (VyOS 1.2.0-rc1) board.Oct 15 2018, 11:58 PM