CVE-2017-7521
27.06.2017, 13:29
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issue in extract_x509_extension().Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| openvpn | openvpn | 𝑥 ≤ 2.3.16 |
| openvpn | openvpn | 2.4.0 |
| openvpn | openvpn | 2.4.0:alpha2 |
| openvpn | openvpn | 2.4.0:beta1 |
| openvpn | openvpn | 2.4.0:beta2 |
| openvpn | openvpn | 2.4.0:rc1 |
| openvpn | openvpn | 2.4.0:rc2 |
| openvpn | openvpn | 2.4.1 |
| openvpn | openvpn | 2.4.2 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| openvpn |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| openvpn-auth-pam-plugin |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| openvpn-dco |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| openvpn-dco-devel |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| openvpn-devel |
|
Common Weakness Enumeration
- CWE-400 - Uncontrolled Resource ConsumptionThe software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
- CWE-415 - Double FreeThe product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
References