CVE catalog

CVE-2018-16758

tinc: CVE-2018-16758

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.95% · Oct 25, 2026

Missing message authentication in the meta-protocol in Tinc VPN version 1.0.34 and earlier allows a man-in-the-middle attack to disable the encryption of VPN packets.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantincsid1.0.36-2.1fixed
Debiantincforky1.0.36-2.1fixed
Debiantinctrixie1.0.36-2.1fixed
Debiantincbookworm1.0.36-2fixed
Alpinetinc3.101.0.35-r0fixed
Alpinetinc3.111.0.35-r0fixed
Alpinetinc3.121.0.35-r0fixed
Alpinetinc3.131.0.35-r0fixed
Alpinetinc3.141.0.35-r0fixed
Alpinetinc3.151.0.35-r0fixed
Alpinetinc3.161.0.35-r0fixed
Alpinetinc3.171.0.35-r0fixed
Alpinetinc3.181.0.35-r0fixed
Alpinetinc3.191.0.35-r0fixed
Alpinetinc3.201.0.35-r0fixed
Alpinetinc3.211.0.35-r0fixed
Alpinetinc3.221.0.35-r0fixed
Alpinetinc3.231.0.35-r0fixed
Alpinetinc3.241.0.35-r0fixed
Alpinetinc3.61.0.35-r0fixed
Alpinetinc3.71.0.35-r0fixed
Alpinetinc3.81.0.35-r0fixed
Alpinetinc3.91.0.35-r0fixed
Ubuntutinc16.041.0.26-1vulnerable
Ubuntutinc18.041.0.31-1vulnerable
Ubuntutinc18.041.0.32-1vulnerable
Ubuntutinc18.041.0.33-1vulnerable
Ubuntutinc18.041.0.33-1build1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantincsourcesid1.0.35-1not yet assignedNot reportedNot reported
Debiantincsourceforky1.0.35-1not yet assignedNot reportedNot reported
Debiantincsourcetrixie1.0.35-1not yet assignedNot reportedNot reported
Debiantincsourcebookworm1.0.35-1not yet assignedNot reportedNot reported
Alpinetincapk3.101.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported
Alpinetincapk3.111.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported
Alpinetincapk3.121.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported
Alpinetincapk3.131.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported
Alpinetincapk3.141.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported
Alpinetincapk3.151.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported
Alpinetincapk3.161.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported
Alpinetincapk3.171.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported
Alpinetincapk3.181.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported
Alpinetincapk3.191.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported
Alpinetincapk3.201.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported
Alpinetincapk3.211.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported
Alpinetincapk3.221.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported
Alpinetincapk3.231.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported
Alpinetincapk3.241.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported
Alpinetincapk3.61.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported
Alpinetincapk3.71.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported
Alpinetincapk3.81.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported
Alpinetincapk3.91.0.35-r0Not reportedALPINE-CVE-2018-16758Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [tinc]Fixed

    Source package: [tinc]

    Details (2)

    • 1.0.36-2+b2 · amd64 · bookworm

      Fixed · Fixed: 1.0.35-1

      dsa · tinc · debian · bookworm; dsa · tinc · debian · 12

    • 1.0.36-2+b2 · arm64 · bookworm

      Fixed · Fixed: 1.0.35-1

      dsa · tinc · debian · bookworm; dsa · tinc · debian · 12

[Debian 13 (Trixie)]

  • [tinc]Fixed

    Source package: [tinc]

    Details (2)

    • 1.0.36-2.1 · amd64 · trixie

      Fixed · Fixed: 1.0.35-1

      dsa · tinc · debian · 13

    • 1.0.36-2.1+b1 · arm64 · trixie

      Fixed · Fixed: 1.0.35-1

      dsa · tinc · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]