CVE-2017-7508 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
redhat	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 75%

Vendor	Product	Version
openvpn	openvpn	𝑥 ≤ 2.3.16
openvpn	openvpn	2.4.0
openvpn	openvpn	2.4.0:alpha2
openvpn	openvpn	2.4.0:beta1
openvpn	openvpn	2.4.0:beta2
openvpn	openvpn	2.4.0:rc1
openvpn	openvpn	2.4.0:rc2
openvpn	openvpn	2.4.1
openvpn	openvpn	2.4.2

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

openvpn

bullseye	2.5.1-3 fixed
wheezy	not-affected
bookworm	2.6.3-1+deb12u2 fixed
bookworm (security)	2.6.3-1+deb12u2 fixed
sid	2.6.12-1 fixed
trixie	2.6.12-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

openvpn

artful	Fixed 2.4.0-5ubuntu2 released
zesty	Fixed 2.4.0-4ubuntu1.3 released
yakkety	Fixed 2.3.11-1ubuntu2.1 released
xenial	Fixed 2.3.10-1ubuntu2.1 released
trusty	Fixed 2.3.2-7ubuntu3.2 released

Common Weakness Enumeration

CWE-617 - Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References

http://www.debian.org/security/2017/dsa-3900

http://www.securityfocus.com/bid/99230

http://www.securitytracker.com/id/1038768

https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243

http://www.debian.org/security/2017/dsa-3900

http://www.securityfocus.com/bid/99230

http://www.securitytracker.com/id/1038768

https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243