Unrated severityNVD Advisory· Published Nov 18, 2013· Updated Apr 29, 2026
CVE-2013-2061
CVE-2013-2061
Description
The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.
Affected products
16cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*+ 13 more
- cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*range: <=2.3.0
- cpe:2.3:a:openvpn:openvpn:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:openvpn:openvpn:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:openvpn:openvpn:1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:openvpn:openvpn:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:openvpn:openvpn:1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:openvpn:openvpn:1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:openvpn:openvpn:1.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:openvpn:openvpn:1.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:openvpn:openvpn:1.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:openvpn:openvpn:1.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:openvpn:openvpn:1.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:openvpn:openvpn:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:openvpn:openvpn:2.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:openvpn:openvpn_access_server:2.0.0:*:*:*:*:*:*:*
Patches
111d21349a4e7https://github.com/OpenVPN/openvpnvia nvd-ref
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
10- github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2eenvdExploitPatch
- lists.opensuse.org/opensuse-updates/2013-11/msg00012.htmlnvdVendor Advisory
- lists.fedoraproject.org/pipermail/package-announce/2013-May/105568.htmlnvd
- lists.fedoraproject.org/pipermail/package-announce/2013-May/105609.htmlnvd
- lists.opensuse.org/opensuse-updates/2013-11/msg00016.htmlnvd
- www.mandriva.com/security/advisoriesnvd
- www.openwall.com/lists/oss-security/2013/05/06/6nvd
- bugs.gentoo.org/show_bug.cginvd
- bugzilla.redhat.com/show_bug.cginvd
- community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67ccnvd
News mentions
0No linked articles in our index yet.