Official statement on GHOST vulnerability? (CVE-2015-0235)

[deleted]

Hello. We use OpenVPN AS and have a concern regarding the recent GHOST vulerability (CVE-2015-0235).

Many common applications (i.e. apache/nginx/mysql) have been declared NOT vulnerable.

We are looking for a statement from the development team(s) regarding OpenVPN access server and openvpn.

More details are available from various sources. Here is one: https://access.redhat.com/security/cve/CVE-2015-0235

passerby

*inofficial*

just downloaded the source of openvpn-2.3.2 and searched for "gethostbyname" calls. As far as I can see it there are no calls to "gethostbyname" and "gethostbyname2" in the source (only some in configure scripts. Therefore, I'd carefully reckon that openvpn is not vulnerable.

relavoie@lgs.com

Is it possible to have a "Official" status ?

Thanks

relavoie@lgs.com

Do you have an "official" status on this vulnerability ?
Thanks