Background
On 15th Oct 2014 the OpenSSL project released 1.0.1j that fixed several security vulnerabilities of high severity or less. Official OpenVPN Windows installers bundle OpenSSL 1.0.1, which meant that the OpenVPN project had to make a new Windows installer release (I004/I604). On *NIX-based operating systems OpenSSL is typically dynamically linked to OpenVPN and the OS provider handles the OpenSSL upgrades.
List of vulnerabilities
| Vulnerability name | ID | Affects OpenVPN? | Mitigation |
|---|---|---|---|
| SRTP Memory Leak | CVE-2014-3513 | Denial-of-service only | TLS auth can[1] protect against this vulnerability |
| Session Ticket Memory Leak | CVE-2014-3567 | Denial-of-service only | TLS auth can[1] protect against this vulnerability |
| SSL 3.0 Fallback protection | CVE-2014-3568 | No SSLv3 in OpenVPN, not affected | |
| Build option no-ssl3 is incomplete | - | No SSLv3 in OpenVPN, not affected |
Analysis of the impact of these vulnerabilities is taken from here.
[1] The amount of protection is limited in environments where the TLS auth key is widely distributed (large organizations) or public (VPN service providers).