Package : tinc Version : 1.0.24-2+deb8u1 CVE ID : CVE-2018-16737 CVE-2018-16758
Several vulnerabilities were discovered in tinc, a Virtual Private
Network (VPN) daemon. The Common Vulnerabilities and Exposures project
identifies the following problems:
CVE-2018-16737
Michael Yonli discovered a flaw in the implementation of the
authentication protocol that could allow a remote attacker to
establish an authenticated, one-way connection with another node.
CVE-2018-16758
Michael Yonli discovered that a man-in-the-middle that has
intercepted a TCP connection might be able to disable encryption of
UDP packets sent by a node.
For Debian 8 "Jessie", these problems have been fixed in version
1.0.24-2+deb8u1.
We recommend that you upgrade your tinc packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
--
Met vriendelijke groet / with kind regards,
Guus Sliepen <[email protected]>
signature.asc
Description: PGP signature
