CVE-2017-7520 — Sensitive Information Exposure in Openvpn

CWE-200 — Sensitive Information ExposureCWE-125 — Out-of-bounds Read12 documents8 sources
Severity
7.4HIGHNVD
OSV5.9
EPSS
0.9%
top 24.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
OpenvpnDebian OpenvpnOpenvpn Technologies INC Openvpn
Timeline
PublishedJun 27
Latest updateMay 13

Description

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:HExploitability: 2.2 | Impact: 5.2

Affected Packages5 packages

▶debiandebian/openvpn< openvpn 2.4.3-1 (bookworm)
▶Debianopenvpn/openvpn< 2.4.3-1+3
▶Ubuntuopenvpn/openvpn< 2.3.2-7ubuntu3.2+1
▶NVDopenvpn/openvpn2.3.16+3
▶CVEListV5openvpn_technologies_inc/openvpnbefore 2.3.17, before 2.4.3+1

🔴Vulnerability Details

3
GHSA
GHSA-757r-jmm6-p24p: OpenVPN versions before 2↗2022-05-13
▶
OSV
CVE-2017-7520: OpenVPN versions before 2↗2017-06-27
▶
OSV
openvpn vulnerabilities↗2017-06-22
▶

📋Vendor Advisories

4
Ubuntu
OpenVPN vulnerability↗2017-08-07
▶
Ubuntu
OpenVPN vulnerabilities↗2017-06-22
▶
Red Hat
openvpn: Multiple security issues fixed in OpenVPN 2.4.3 and 2.3.17↗2017-06-21
▶
Debian
CVE-2017-7520: openvpn - OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-serv...↗2017
▶

💬Community

4
HackerOne
4 severe remote + several minor OpenVPN vulnerabilities↗2019-10-14
▶
Bugzilla
CVE-2017-7508 CVE-2017-7520 CVE-2017-7521 CVE-2017-7522 openvpn: Multiple security issues fixed in OpenVPN 2.4.3 and 2.3.17↗2017-06-21
▶
Bugzilla
CVE-2017-7508 CVE-2017-7520 CVE-2017-7521 CVE-2017-7522 openvpn: Multiple security issues fixed in OpenVPN 2.4.3 and 2.3.17 [epel-all]↗2017-06-21
▶
Bugzilla
CVE-2017-7508 CVE-2017-7520 CVE-2017-7521 CVE-2017-7522 openvpn: Multiple security issues fixed in OpenVPN 2.4.3 and 2.3.17 [fedora-all]↗2017-06-21
▶