ian darke
This question was raised in the middle of the sticky thread and was also raised in a separate thread on this forum (although with a subject that was IMHO not clear enough to gain attention).
What are the specific risks if we have old clients connecting to a patched server? I understand that the handshake bug allows for you to collect a chunk of the servers memory. I don't understand how this vulnerability works for the clients. Is the risk that if someone had control of my server (or if I was malicious) and someone connected with an old client that their system memory could be compromised?
hansemann
I would also be interested in this. Do the clients need to update their OpenVPN and OpenSSL binaries?
claudi
Yes it is a huge riks for the whole service and that's why nobody wants to answer it in public.
Change to another not from heartbleed affected VPN solution and you are secure again.
Otherwise you have to force all your users to OpenVPN 2.3.3. (using environment variables)
