wheelybird/openvpn-server-ldap-otp

COMP-LZO should be disabled by default

ragaar opened this issue · 2 comments

ragaar commented

Security researcher Ahamed Nafeez has ​presented a new attack vector which targets VPN tunnels which utilize compression, named VORACLE.[1]

REFERENCE

  1. https://community.openvpn.net/openvpn/wiki/VORACLE
wheelybird commented

Hi.
Thanks for letting me know about this. Unfortunately I don't think I can make this a default option because if someone updates the server but not the client configs then the connections will fail.
OpenVPN Access server allows the client to request compression, but of course we're not using that.

I'll look into making compression optional via env variables and update the documentation to highlight that vulnerability.

  • ❤️1
wheelybird commented

The option to disable compression (OVPN_ENABLE_COMPRESSION=false) has been added and the Docker container image updated.