CVE-2017-7508 — Reachable Assertion in Openvpn

CWE-617 — Reachable Assertion11 documents8 sources
Severity
7.5HIGHNVD
OSV5.9
EPSS
0.4%
top 41.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
OpenvpnDebian OpenvpnOpenvpn Technologies INC Openvpn
Timeline
PublishedJun 27
Latest updateMay 13

Description

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶debiandebian/openvpn< openvpn 2.4.3-1 (bookworm)
▶Debianopenvpn/openvpn< 2.4.3-1+3
▶Ubuntuopenvpn/openvpn< 2.3.2-7ubuntu3.2+1
▶NVDopenvpn/openvpn2.3.16+3
▶CVEListV5openvpn_technologies_inc/openvpnbefore 2.3.17, before 2.4.3+1

🔴Vulnerability Details

3
GHSA
GHSA-q55c-22v4-x379: OpenVPN versions before 2↗2022-05-13
▶
OSV
CVE-2017-7508: OpenVPN versions before 2↗2017-06-27
▶
OSV
openvpn vulnerabilities↗2017-06-22
▶

📋Vendor Advisories

3
Ubuntu
OpenVPN vulnerabilities↗2017-06-22
▶
Red Hat
openvpn: Multiple security issues fixed in OpenVPN 2.4.3 and 2.3.17↗2017-06-21
▶
Debian
CVE-2017-7508: openvpn - OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-...↗2017
▶

💬Community

4
HackerOne
4 severe remote + several minor OpenVPN vulnerabilities↗2019-10-14
▶
Bugzilla
CVE-2017-7508 CVE-2017-7520 CVE-2017-7521 CVE-2017-7522 openvpn: Multiple security issues fixed in OpenVPN 2.4.3 and 2.3.17↗2017-06-21
▶
Bugzilla
CVE-2017-7508 CVE-2017-7520 CVE-2017-7521 CVE-2017-7522 openvpn: Multiple security issues fixed in OpenVPN 2.4.3 and 2.3.17 [epel-all]↗2017-06-21
▶
Bugzilla
CVE-2017-7508 CVE-2017-7520 CVE-2017-7521 CVE-2017-7522 openvpn: Multiple security issues fixed in OpenVPN 2.4.3 and 2.3.17 [fedora-all]↗2017-06-21
▶