Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-13698: An internal server error condition that can be triggered by a malicous authenticated client, a very unlucky corruption of packets in transit or by an attacker that is able to inject a specially created packet at the right time and is able to observe the traffic to construct the packet. CVE-2026-13117: When dynamic tls-crypt is active, it is possible for tls_multi_process to set to_link to session->tls_wrap_reneg.work and later free that session, leaving to_link.data pointing to freed memory. CVE-2026-12932: OpenVPN memory-leak in tls-crypt-v2 client key handling that could lead to out-of-memory situations and subsequent server crashes
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | openvpn | 0:2.6.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | openvpn-debuginfo | 0:2.6.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | openvpn-debugsource | 0:2.6.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | openvpn-devel | 0:2.6.12-1.amzn2023.0.7 |
Vulnerabilities 3
-
High 7.1
A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 al…
-
Medium 6.0
An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to t…
-
Medium 6.0
A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote …