CVE-2016-6329: openvpn
CVSS: 5.9v3.0MediumModified
AliasesMGASA-2016-0304UBUNTU-CVE-2016-6329DEBIAN-CVE-2016-6329
Published 31-01-2017Last modified 06-08-2024
Vulnerability summary
CVE-2016-6329 is a medium (CVSS 5.9) vulnerability in openvpn. EPSS estimates a 5.94% chance of exploitation in the next 30 days, higher than 93.2% of scored vulnerabilities.
CVSS score
5.9/10
010
Medium · v3.0 (NVD)EPSS score
5.94%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 31-01-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTP-over-OpenVPN session using Blowfish in CBC mode, aka a "Sweet32" attack.
CVSS metrics
4 scores · 3 sources · 2 versionsMedium 5.9Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
5.94%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 5.94% on 20-09-2026
20-09-202620-10-2026
EPSS score5.94%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-310Cryptographic IssuesWeaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Affected systems
Debian1 product
- openvpnAll versions (No fix recorded)
Mageia1 product
- openvpn< 2.3.12-1.mga5
Openvpn1 product
- openvpn≤ 2.3.14
Ubuntu1 product
- openvpn< 2.3.2-7ubuntu3.2 | < 2.3.10-1ubuntu2.1
4 vendors · 4 products
References
18 links- h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403X Refsource CONFIRMThird Party Advisory
- www-01.ibm.com/support/docview.wss?uid=nas8N1021697X Refsource CONFIRMPermissions RequiredThird Party Advisory
- cert-portal.siemens.com/productcert/pdf/ssa-556833.pdfX Refsource CONFIRM
