Security issues in OpenVPN package

[virtualprivate]

A number of vulnerabilities were discovered in the recent audit (press release) of OpenVPN, fixed in full in version 2.4.3 and 2.3.17 respectively.

With a fully updated Raspbian Jessie I get version 2.3.4 of OpenVPN, which is then vulnerable. Is there a way to retrieve the last 2.3.x version or even follow the 2.4.x branch?

[ShiftPlusOne]

The version is not important. Debian backport security fixes into their packages.

[boxerclaws88]

How can I tell for my self which security updates have been applied to individual Raspbian packages? Usually individual software maintainers specify "upgrade to version x.y.z to fix vulnerability W" but it seems the fixes are kinda patched into older versions. I don't really care if its easy or not, I just want to know the exact procedure to follow to verify which fixes have been applied and which packages are still vulnerable.

[rpdom]

Check the Debian changelog file. Probably /usr/share/doc/openvpn/changelog.Debian.gz It is a gzipped file, so you can read it with zless /usr/share/doc/openvpn/changelog.Debian.gz You will also notice that the version number has some "+deb8u1" type bits on the end and those relate to the Debian security fixes.

[boxerclaws88]

So I guess it is still vulnerable, great, any idea when its going to get fixed?

[Learntofly]

Compile it yourself it's quite easy:

Get the tarball from the openvpn website, untar and enter its directory

Install the usual build packages, including cmake, also install the latest openssl (manually get them from one of the mirror repositories ), install liblzo2-dev, liblz4, liblz4-dev

Code: Select all

./configure --prefix=/usr

Code: Select all

make

either

Code: Select all

sudo make install

or install checkinstall and

Code: Select all

sudo checkinstall

then use dpkg to install the .deb

LTF

[boxerclaws88]

Yeah I could do just that. But. It begs the question, if they are this slow on this one security update, how many other security problems with other packages that I haven't looked into or that I'm not aware of?

[rpdom]

So I guess it is still vulnerable, great, any idea when its going to get fixed?

That's quite a recent (and apparently minor) issue. No doubt the Debian developers are working on backporting the fixes right now. As to timescale... ask them. Once it is in Debian Jessie it will be quickly added to the Raspbian repository.

Serious issues get patched quickly (then tested to make sure they work before release into the wild).