CVE-2017-7478: Input Validation
Published May 15, 2017
·Updated
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.
Affected Software
10 affected components
OpenVPN OpenVPN=2.3.12
OpenVPN OpenVPN=2.3.13
OpenVPN OpenVPN=2.3.14
OpenVPN OpenVPN=2.4.0
OpenVPN OpenVPN=2.4.0-alpha2
OpenVPN OpenVPN=2.4.0-beta1
OpenVPN OpenVPN=2.4.0-beta2
OpenVPN OpenVPN=2.4.0-rc1
OpenVPN OpenVPN=2.4.0-rc2
OpenVPN OpenVPN=2.4.1
Event History
May 15, 2017
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-7478?
CVE-2017-7478 is categorized as a medium severity vulnerability due to the risk of Denial of Service attacks.
2
How do I fix CVE-2017-7478?
To fix CVE-2017-7478, upgrade to OpenVPN version 2.3.15 or 2.4.2 or later.
3
What versions of OpenVPN are affected by CVE-2017-7478?
OpenVPN versions 2.3.12 to 2.4.1, including 2.3.13, 2.3.14, and various 2.4.0 pre-release versions, are affected by CVE-2017-7478.
4
What is the impact of CVE-2017-7478 on users?
CVE-2017-7478 can lead to an unauthenticated Denial of Service on the OpenVPN server.
5
Is there a known exploit for CVE-2017-7478?
As of the information available, there are no publicly disclosed exploits for CVE-2017-7478.