CVE-2017-7478
High · 7.5CVSS
7.5
EPSS
13.8%
Published
May 15, 2017
CISA due date
—
The record
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Alpine:v3.5 | openvpn | 0 | 2.3.15-r0 |
| Alpine:v3.6 | openvpn | 0 | 2.4.2-r0 |
| Debian:11 | openvpn | 0 | 2.4.0-5 |
| Debian:12 | openvpn | 0 | 2.4.0-5 |
| Debian:13 | openvpn | 0 | 2.4.0-5 |
| Mageia:5 | openvpn | 0 | 2.3.16-1.mga5 |
| SUSE:Linux Enterprise Desktop 12 SP2 | openvpn | 0 | 2.3.8-16.14.1 |
| SUSE:Linux Enterprise Point of Sale 11 SP3 | openvpn | 0 | 2.0.9-143.47.3.1 |
| SUSE:Linux Enterprise Server 11 SP3-LTSS | openvpn | 0 | 2.0.9-143.47.3.1 |
| SUSE:Linux Enterprise Server 11 SP3-TERADATA | openvpn | 0 | 2.0.9-143.47.3.1 |
| SUSE:Linux Enterprise Server 11 SP4 | openvpn | 0 | 2.0.9-143.47.3.1 |
| SUSE:Linux Enterprise Server 11-SECURITY | openvpn-openssl1 | 0 | 2.3.2-0.9.1 |
| SUSE:Linux Enterprise Server 12 SP2 | openvpn | 0 | 2.3.8-16.14.1 |
| SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | openvpn | 0 | 2.3.8-16.14.1 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | openvpn | 0 | 2.0.9-143.47.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | openvpn | 0 | 2.3.8-16.14.1 |
Related vulnerabilities
- CVE-2024-5594 OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which attackers can… Also affects openvpn
- CVE-2016-6329 OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain… Also affects openvpn
- CVE-2014-8104 OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows… Also affects openvpn
- CVE-2023-46850 Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking… Also affects openvpn
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-20
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-20
- CVE-2026-111869 A vulnerability was identified in makeplane plane up to 1.4.2. CWE-20
- CVE-2026-100347 kin-openapi is a Go project for handling OpenAPI files. CWE-20