The host is installed with OpenVPN 2.3.0 and earlier are prone to information disclosure vulnerability. The flaw is present in the application, which fails to properly handle the openvpn_decrypt function in crypto.c. Successful exploitation allows remote attackers to cause timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.