CVE-2018-16758: Debian Linux

Medium severity, CVSS 5.9. EPSS: 0.9% chance of exploitation in the next 30 days.

Missing message authentication in the meta-protocol in Tinc VPN version 1.0.34 and earlier allows a man-in-the-middle attack to disable the encryption of VPN packets.

Affected products

• Debian Debian Linux: version 9.0 only
• Starwindsoftware Starwind Virtual San: version v8 only
• Tinc-VPN Tinc: up to and including 1.0.34

Published 2018-10-10. Last modified 2026-06-17.