CVE-2017-7508 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 39%

Affected Products (NVD)

Vendor	Product	Version
openvpn	openvpn	𝑥 ≤ 2.3.16
openvpn	openvpn	2.4.0
openvpn	openvpn	2.4.0:alpha2
openvpn	openvpn	2.4.0:beta1
openvpn	openvpn	2.4.0:beta2
openvpn	openvpn	2.4.0:rc1
openvpn	openvpn	2.4.0:rc2
openvpn	openvpn	2.4.1
openvpn	openvpn	2.4.2

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

openvpn

bookworm	2.6.3-1+deb12u2 fixed
bookworm (security)	2.6.3-1+deb12u2 fixed
bullseye	2.5.1-3 fixed
sid	2.6.12-1 fixed
trixie	2.6.12-1 fixed
wheezy	not-affected

Ubuntu Releases

Ubuntu Product

Codename

openvpn

artful	Fixed 2.4.0-5ubuntu2 released
trusty	Fixed 2.3.2-7ubuntu3.2 released
xenial	Fixed 2.3.10-1ubuntu2.1 released
yakkety	Fixed 2.3.11-1ubuntu2.1 released
zesty	Fixed 2.4.0-4ubuntu1.3 released

openSUSE / SLES Releases

openSUSE Product

Release

openvpn

suse enterprise sap 12 SP2	2.3.8-16.17.1 fixed
suse enterprise sap 12 SP5	2.3.8-16.20.1 fixed
suse enterprise server 12	2.3.8-16.17.1 fixed
suse enterprise server 12 SP1	2.3.8-16.17.1 fixed
suse enterprise server 12 SP2	2.3.8-16.17.1 fixed
suse enterprise server 12 SP3	2.3.8-16.17.1 fixed
suse enterprise server 12 SP4	2.3.8-16.20.1 fixed
suse enterprise server 12 SP5	2.3.8-16.20.1 fixed

openvpn-auth-pam-plugin

suse enterprise sap 12 SP2	2.3.8-16.17.1 fixed
suse enterprise sap 12 SP5	2.3.8-16.20.1 fixed
suse enterprise server 12	2.3.8-16.17.1 fixed
suse enterprise server 12 SP1	2.3.8-16.17.1 fixed
suse enterprise server 12 SP2	2.3.8-16.17.1 fixed
suse enterprise server 12 SP3	2.3.8-16.17.1 fixed
suse enterprise server 12 SP4	2.3.8-16.20.1 fixed
suse enterprise server 12 SP5	2.3.8-16.20.1 fixed

Common Weakness Enumeration

CWE-617 - Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References

http://www.debian.org/security/2017/dsa-3900

http://www.securityfocus.com/bid/99230

http://www.securitytracker.com/id/1038768

https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243

http://www.debian.org/security/2017/dsa-3900

http://www.securityfocus.com/bid/99230

http://www.securitytracker.com/id/1038768

https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243