CVE-2017-7521
EUVD-2017-1653827.06.2017, 13:29
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issue in extract_x509_extension().Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| openvpn | openvpn | 𝑥 ≤ 2.3.16 |
| openvpn | openvpn | 2.4.0 |
| openvpn | openvpn | 2.4.0:alpha2 |
| openvpn | openvpn | 2.4.0:beta1 |
| openvpn | openvpn | 2.4.0:beta2 |
| openvpn | openvpn | 2.4.0:rc1 |
| openvpn | openvpn | 2.4.0:rc2 |
| openvpn | openvpn | 2.4.1 |
| openvpn | openvpn | 2.4.2 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-400 - Uncontrolled Resource ConsumptionThe software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
- CWE-415 - Double FreeThe product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
References