Univention Bugzilla – Bug 31347
openvpn: Insecure HMAC comparison (3.1)
Last modified: 2013-11-19 06:43:07 CET
+++ This bug was initially created as a clone of Bug #31346 +++
+++ This bug was initially created as a clone of Bug #31345 +++
An information leak in the implementation of HMAC comparisons can allow a
chosen ciphertext attack. This is currently only known to be exploitable with
PolarSSL (which isn't used in UCS) and generally only exploitable with an
attacker being the man-in-the-middle.
More information in the upstream announcement:
Fixed in 3.2 through the import of Debian 6.0.8.
The QA should ideally be made by the same person as for Bug 31956.
(In reply to Moritz Muehlenhoff from comment #1)
> Fixed in 3.2 through the import of Debian 6.0.8.
UCS 3.2 has been released:
If this error occurs again, please use "Clone This Bug".