Description
The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.
Remediation
References
Related Vulnerabilities
WordPress Plugin Gravity Forms Information Disclosure (2.4.8)
WordPress 4.0.x Multiple Vulnerabilities (4.0 - 4.0.13)
Django Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-9014)
WordPress Multiple Cross-Site Scripting Vulnerabilities (4.1 - 4.2.1)
WordPress Plugin The Events Calendar Unspecified Vulnerability (4.0.4)