OpenVPN AS and the recent OpenSSL vulnerability

steveberryman

What's the best upgrade path for OpenSSL and OpenVPN AS with the latest vulnerability disclosure? Is upgrading the OpenSSL libraries on the host good enough, or will that break things?

Referring to this: http://heartbleed.com

harald@brabantia.com

I would like to know to !
How do we upgrade openssl on the Access server ?
Solution needed urgently !

themystic

Judging by the number of views on this post, you're not alone in hoping to get some answers. I have tried updating OpenSSL to a patched version on my host, but that does not fix the problem. It looks like OpenVPN AS is shipped with a vulnerable version: /usr/local/openvpn_as/lib/libssl.so

So in short: For me updating OpenSSL of the host didn't break anything, but it didn't fix the vuln for OpenVPN AS either. Guess we're stuck waiting for an update from OpenVPN Tech..

jacksoncage

I can confirm that only updating OpenSSL libs on Debian Wheezy won't help.

OpenVPN Tech needs to provide a patch/update. I've added a support ticket and will post the update here.

tiagocruz

This last version 2.0.5 does NOT solve this problem, right?

http://openvpn.net/index.php/access-server/download-openvpn-as-sw/532-release-notes-v200.html

$ rpm -qpl openvpn-as-2.0.5-CentOS6.x86_64.rpm  | grep libssl
/usr/local/openvpn_as/lib/libssl.so
/usr/local/openvpn_as/lib/libssl.so.1.0.0
/usr/local/openvpn_as/lib/pkgconfig/libssl.pc

-- edit

http://sourceforge.net/p/openvpn/mailman/openvpn-devel/thread/5344111D.3080408%40openvpn.net/#msg32201493

Hi all,

We'll try to push OpenVPN 2.3.3 out today. The Windows installer will
contain OpenSSL 1.0.1g which fixes this particular problem. In addition
several other small changes and enhancements will be included.

--
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

killcity

Can't you just rename/remove the affected, bundled OpenVPN OpenSSL lib and symlink to the new, patched, Ubuntu lib?

/usr/local/openvpn_as/lib/libssl.so.1.0.0 <-- bundled

/lib/x86_64-linux-gnu/libssl.so.1.0.0 <-- patched (https://launchpad.net/ubuntu/+source/openssl/1.0.1e-3ubuntu1.2)

ecrist

Please see this thread: https://forums.openvpn.net/post39904.html#p39904