CVE catalog

CVE-2016-6329

DEBIAN-CVE-2016-6329

Severity: Medium · CVSS 5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: Jan 31, 2017, 12:00:00 AM UTC
Updated: Feb 4, 2026, 4:16:52 AM UTC
Source: [NVD] · [CVE record]
EPSS: 5.94% · Oct 25, 2026

OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTP-over-OpenVPN session using Blowfish in CBC mode, aka a "Sweet32" attack.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Ubuntu	openvpn	14.04	`2.3.2-4ubuntu1`	vulnerable
Ubuntu	openvpn	14.04	`2.3.2-5ubuntu1`	vulnerable
Ubuntu	openvpn	14.04	`2.3.2-7ubuntu1`	vulnerable
Ubuntu	openvpn	14.04	`2.3.2-7ubuntu2`	vulnerable
Ubuntu	openvpn	14.04	`2.3.2-7ubuntu3`	vulnerable
Ubuntu	openvpn	14.04	`2.3.2-7ubuntu3.1`	vulnerable
Ubuntu	openvpn	14.04	`2.3.2-7ubuntu3.2`	fixed
Ubuntu	openvpn	16.04	`2.3.7-1ubuntu1`	vulnerable
Ubuntu	openvpn	16.04	`2.3.7-2ubuntu1`	vulnerable
Ubuntu	openvpn	16.04	`2.3.8-1ubuntu1`	vulnerable
Ubuntu	openvpn	16.04	`2.3.10-1ubuntu1`	vulnerable
Ubuntu	openvpn	16.04	`2.3.10-1ubuntu2`	vulnerable
Ubuntu	openvpn	16.04	`2.3.10-1ubuntu2.1`	fixed
Suse	openvpn	linux enterprise point of sale 11 sp3	`2.0.9-143.47.3.1`	fixed
Suse	openvpn	linux enterprise server 11 sp3-ltss	`2.0.9-143.47.3.1`	fixed
Suse	openvpn	linux enterprise server 11 sp3-teradata	`2.0.9-143.47.3.1`	fixed
Suse	openvpn	linux enterprise server 11 sp4	`2.0.9-143.47.3.1`	fixed
Suse	openvpn	linux enterprise server for sap applications 11 sp4	`2.0.9-143.47.3.1`	fixed
Suse	openvpn	linux enterprise desktop 12 sp2	`2.3.8-16.14.1`	fixed
Suse	openvpn	linux enterprise server for raspberry pi 12 sp2	`2.3.8-16.14.1`	fixed
Suse	openvpn	linux enterprise server 12 sp2	`2.3.8-16.14.1`	fixed
Suse	openvpn	linux enterprise server for sap applications 12 sp2	`2.3.8-16.14.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Ubuntu	openvpn	deb	14.04	`2.3.2-7ubuntu3.2`	Not reported	UBUNTU-CVE-2016-6329	Not reported
Ubuntu	openvpn	deb	16.04	`2.3.10-1ubuntu2.1`	Not reported	UBUNTU-CVE-2016-6329	Not reported
Suse	openvpn	rpm	linux enterprise point of sale 11 sp3	`2.0.9-143.47.3.1`	Not reported	SUSE-SU-2017:2838-1	Not reported
Suse	openvpn	rpm	linux enterprise server 11 sp3-ltss	`2.0.9-143.47.3.1`	Not reported	SUSE-SU-2017:2838-1	Not reported
Suse	openvpn	rpm	linux enterprise server 11 sp3-teradata	`2.0.9-143.47.3.1`	Not reported	SUSE-SU-2017:2838-1	Not reported
Suse	openvpn	rpm	linux enterprise server 11 sp4	`2.0.9-143.47.3.1`	Not reported	SUSE-SU-2017:2838-1	Not reported
Suse	openvpn	rpm	linux enterprise server for sap applications 11 sp4	`2.0.9-143.47.3.1`	Not reported	SUSE-SU-2017:2838-1	Not reported
Suse	openvpn	rpm	linux enterprise desktop 12 sp2	`2.3.8-16.14.1`	Not reported	SUSE-SU-2017:1622-1	Not reported
Suse	openvpn	rpm	linux enterprise server for raspberry pi 12 sp2	`2.3.8-16.14.1`	Not reported	SUSE-SU-2017:1622-1	Not reported
Suse	openvpn	rpm	linux enterprise server 12 sp2	`2.3.8-16.14.1`	Not reported	SUSE-SU-2017:1622-1	Not reported
Suse	openvpn	rpm	linux enterprise server for sap applications 12 sp2	`2.3.8-16.14.1`	Not reported	SUSE-SU-2017:1622-1	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed: Oct 23, 2026, 5:22:37 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]