VULNERABILITY INTELLIGENCE
CVE-2013-2061
CVSS score2.6 LOW
EPSS probability2.81%
CISA KEVNot currently listed
Published2013-11-18
Last modified2026-06-16
CVSS vectorAV:N/AC:H/Au:N/C:P/I:N/A:N
Description
The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.
Weakness classification
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor