CVE-2017-7479

EPSS 0.81%
Veröffentlicht 15.05.2017 18:29:00
Zuletzt bearbeitet 20.04.2025 01:37:25
Quelle secalert@redhat.com
Teams Watchlist Login
Unerledigt Login

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 7

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Openvpn ≫ Openvpn Version <= 2.3.14

Openvpn ≫ Openvpn Version2.4.0

Openvpn ≫ Openvpn Version2.4.0 Updatealpha2

Openvpn ≫ Openvpn Version2.4.0 Updatebeta1

Openvpn ≫ Openvpn Version2.4.0 Updatebeta2

Openvpn ≫ Openvpn Version2.4.0 Updaterc1

Openvpn ≫ Openvpn Version2.4.0 Updaterc2

Openvpn ≫ Openvpn Version2.4.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.81%	0.732

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	6.5	2.8	3.6	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:N/I:N/A:P

CWE-617 Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

http://www.securitytracker.com/id/1038473

https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits

Vendor Advisory

http://www.debian.org/security/2017/dsa-3900

http://www.securityfocus.com/bid/98443

https://nvd.nist.gov/vuln/detail/CVE-2017-7479

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-7479

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-7479

EUVD