dmp
Hello
I have a server runnning OpenVPN Version: 2.3.2-debian0 on Debian oldstable (squeeze) (using tls-auth) which still uses OpenSSL 0.9.8 which is not affected by the heartbleed bug.
However I have no guarrentee that client systems are not using vulnerable versions of openssl.
Is it the case that even if OpenVPN traffic between the clients and my server was not vulnerable I should assume that information from these sessions could have still been in memory if the client subsequently connected to a web site running an affected version of OpenSSL?
In which case I assume I need to block such clients until they have been patched and revoke and reissue their certificates? and possibly the server certificate as well?
Thanks
DMP
