Can anyone comment on whether/how IPFire is affected by OpenSSL CVE-2026-84782 ( OpenSSL Fixes High-Severity DTLS Flaw That Can Leak Heap Memory Unencrypted )
For example, could OpenVPN listening on UDP port 1194 be affected?
As far as I can tell, the answer is probably not because OpenVPN does not use the OpenSSL DLTS process but implements their TLS control channel code themselves. However I am not an expert in any of this so can’t guarantee that my interpretation is correct.
The fixed version of openssl is already in Core Update 204 which was released for Testing this morning.
EDIT:
Also if you have enabled TLS Channel Protection, which is the default setting in IPFire then an attacker cannot even initiate a TLS handshake without being able to generate packets with the correct HMAC signature.