Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2017-7478

Published: 11 May 2017

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.

From the Ubuntu Security Team

It was discovered that OpenVPN improperly triggered an assert when receiving an oversized control packet. A remote attacker could use this to cause a denial of service (server or client crash).

Notes

AuthorNote
sbeattie
introduced in 3c1b19e04745177185decd14da82c71458442b82
(2.4.0); also was backported to 2.3 in
358f513c008bf01fadb82759ac75ffb8613fc785 (2.3.12)

Priority

High

CVSS 3 base score: 7.5

Status

Package Release Status
openvpn
Launchpad, Ubuntu, Debian
precise Not vulnerable

trusty Not vulnerable

upstream
Released (2.4.0-5)
xenial Not vulnerable

yakkety Not vulnerable

zesty
Released (2.4.0-4ubuntu1.2)