Debian Security Advisory
DSA-3084-1 openvpn -- security update
- Date Reported:
- 01 Dec 2014
- Affected Packages:
- openvpn
- Vulnerable:
- Yes
- Security database references:
- In Mitre's CVE dictionary: CVE-2014-8104.
- More information:
-
Dragana Damjanovic discovered that an authenticated client could crash an OpenVPN server by sending a control packet containing less than four bytes as payload.
For the stable distribution (wheezy), this problem has been fixed in version 2.2.1-8+deb7u3.
For the unstable distribution (sid), this problem has been fixed in version 2.3.4-5.
We recommend that you upgrade your openvpn packages.