CVE-2017-7520

Published: Jun 27, 2017Modified: May 13, 2026

7.4

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Exploitability: 2.2 / Impact: 5.2

Source: NVD

Description

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker.

Affected (9)

Products: Openvpn: Openvpn

1 product

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Openvpn Openvpn	Up to 2.3.16
Openvpn Openvpn	Version 2.4.0
Openvpn Openvpn	Version 2.4.0 alpha2
Openvpn Openvpn	Version 2.4.0 beta1
Openvpn Openvpn	Version 2.4.0 beta2
Openvpn Openvpn	Version 2.4.0 rc1
Openvpn Openvpn	Version 2.4.0 rc2
Openvpn Openvpn	Version 2.4.1
Openvpn Openvpn	Version 2.4.2

Related CWEs

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (8)

http://www.debian.org/security/2017/dsa-3900

Source: secalert@redhat.com

http://www.securityfocus.com/bid/99230

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1038768

Source: secalert@redhat.com

https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243

Source: secalert@redhat.com

Vendor Advisory

http://www.debian.org/security/2017/dsa-3900

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/99230

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1038768

Source: af854a3a-2127-422b-91ae-364da2661108

https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.