Summary
Joshua Rogers discovered that OpenVPN incorrectly handled HMAC verification
checks. A remote attacker could possibly use this issue to bypass source IP
address validation.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | openvpn | 2.6.14-0ubuntu0.24.04.3 |
| Ubuntu · 25.10 | openvpn | 2.6.14-2ubuntu1.1 |
Vulnerabilities 1
-
Medium 4.6
Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allow…
References
-
report
https://ubuntu.com/security/CVE-2025-13086