Bugzilla – Bug 995374
VUL-0: CVE-2016-6329: openvpn: affected by 64bit cipher birthday attack (SWEET32)
Last modified: 2020-04-23 15:01:28 UTC
https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23 https://sweet32.info/ openvpn supports some 64bit ciphers still, which could be affected by the birthday attack against these small bit amount ciphers as described on sweet32.info. Overview of changes in OpenVPN v2.3 ... Discourage using 64-bit block ciphers ...
CVE-2016-6329 seems used
blowfish and triple-des might be used by openvpn
bugbot adjusting priority
This is an autogenerated message for OBS integration: This bug (995374) was mentioned in https://build.opensuse.org/request/show/500570 42.2 / openvpn https://build.opensuse.org/request/show/500580 42.3 / openvpn
SUSE-SU-2017:1622-1: An update that solves three vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1038709,1038711,1038713,995374 CVE References: CVE-2016-6329,CVE-2017-7478,CVE-2017-7479 Sources used: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): openvpn-2.3.8-16.14.1 SUSE Linux Enterprise Server 12-SP2 (src): openvpn-2.3.8-16.14.1 SUSE Linux Enterprise Desktop 12-SP2 (src): openvpn-2.3.8-16.14.1
openSUSE-SU-2017:1638-1: An update that solves three vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1038709,1038711,1038713,995374 CVE References: CVE-2016-6329,CVE-2017-7478,CVE-2017-7479 Sources used: openSUSE Leap 42.2 (src): openvpn-2.3.8-8.6.1
can you also include in sles11 sp4?
Marcus， an L3 incident has already been created for bsc#1056470. Since there is big change between sles11sp4 and sles12sp2 for openvpn, I have to wait for Nirmoy's patch and provide the PTF then.
SUSE-SU-2017:2838-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1038709,1038711,1038713,1060877,995374 CVE References: CVE-2016-6329,CVE-2017-12166,CVE-2017-7478,CVE-2017-7479 Sources used: SUSE Linux Enterprise Server 11-SP4 (src): openvpn-2.0.9-143.47.3.1 SUSE Linux Enterprise Server 11-SP3-LTSS (src): openvpn-2.0.9-143.47.3.1 SUSE Linux Enterprise Point of Sale 11-SP3 (src): openvpn-2.0.9-143.47.3.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): openvpn-2.0.9-143.47.3.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): openvpn-2.0.9-143.47.3.1
released
Done