peterdguru There is a new vulnerability CVE-2012-2110 in OpenSSL. Details are here : http://lists.grok.org.uk/pipermail/full-disclosure/2012-April/086585.html Is this going to allow remote exploit of OpenVPN? Thanks Peter
janjust this vulnerability is currently being investigated on the openvpn-devel mailing list. At first glance, the answer to your question is 'no' - only the loading of a pkcs12 file is at risk. As long as openvpn only loads 'trusted' pkcs12 files then it is not vulnerable, nor is there risk of a remote exploit. The largest risk seems to be when users are given doctored pkcs12 files - but even then, only that user is at risk, not the entire VPN.
