CVE-2017-12166: Buffer Overflow
Published Oct 3, 2017
·Updated
Last updated 11 March 2025
Other sources
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.
Affected Software
4 affected componentsFixes available
OpenVPN OpenVPN<2.3.18
OpenVPN OpenVPN>=2.4.0<2.4.4
Debian Debian Linux=9.0
debian/openvpn
2.5.1-32.5.1-3+deb11u12.6.3-1+deb12u22.6.13-12.6.14-1
Remediation
Patch Available
Event History
Oct 3, 2017
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Mar 11, 2025
Data Sourced
via Launchpad·04:33 AM
Description
Mar 15, 2025
Data Sourced
via Ubuntu·04:33 AM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-12166?
CVE-2017-12166 is classified as a high severity vulnerability due to the potential for code execution resulting from a buffer overflow.
2
How do I fix CVE-2017-12166?
To mitigate CVE-2017-12166, upgrade OpenVPN to version 2.3.3 or later, or 2.4.4 or later.
3
What versions are affected by CVE-2017-12166?
CVE-2017-12166 affects OpenVPN versions prior to 2.3.3 and versions in the 2.4.x range before 2.4.4.
4
What causes CVE-2017-12166?
CVE-2017-12166 is caused by a buffer overflow vulnerability that occurs when using key-method 1 in OpenVPN.
5
Is CVE-2017-12166 exploitable remotely?
Yes, CVE-2017-12166 can be exploited remotely, allowing an attacker to execute arbitrary code.