BSD PortsOpenVPN -- HMAC verification on source IP address ineffective
· CVE-2025-13086 · VuXML entry
Arne Schwabe reports: Fix memcmp check for the hmac verification in the 3way handshake being inverted This is a stupid mistake but causes all hmac cookies to be accepted, thus breaking source IP address validation. As a consequence, TLS sessions can be openend and state can be consumed in the server from IP addresses that did not initiate an initial connection. While at it, fix check to only allow [t-2;t] timeslots, …
Affected versions
- openvpn < 2.6.16
- openvpn-devel < g20251117,1
By system
1 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | security/openvpn | 2.6.14 | vulnerable since 2025-11-17 | |
| OpenBSD | net/openvpn | 2.7.8 | out of range, by version | |
| NetBSD | net/openvpn | 2.7.7 | not listed | |
| MidnightBSD | security/openvpn | 2.6.14_1 | in range, by version | |
| FreeBSD | security/openvpn | 2.7.8 | fixed | (226 days after) |
| FreeBSD | security/openvpn-devel | g20260907,2 | fixed | (250 days after) |