Debian DSA-4312-1 Tinc VPN Security Flaws Moderately Avoided

CVE-2018-16738

Michael Yonli discovered a flaw in the implementation of the
authentication protocol that could allow a remote attacker to
establish an authenticated, one-way connection with another node.

CVE-2018-16758

Michael Yonli discovered that a man-in-the-middle that has
intercepted a TCP connection might be able to disable encryption of
UDP packets sent by a node.

For the stable distribution (stretch), these problems have been fixed in
version 1.0.31-1+deb9u1.

We recommend that you upgrade your tinc packages.

For the detailed security status of tinc please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/source-package/tinc

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/