p PatchFirst

CVE-2017-7478

CVE-2017-7478

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.

CVSS 7.5 · High · EPSS 13.8% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • openvpn

    Versions
    • 2.3.12 and newer: Affected

    No fix published

  • openvpn Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.4.0-5

    Update to 2.4.0-5

  • openvpn Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.4.0-5

    Update to 2.4.0-5

  • openvpn Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.4.0-5

    Update to 2.4.0-5

Original sources

Check your server →