CVE-2017-7478

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-7478
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7478.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-7478
Downstream
Related
Published
2017-05-15T18:29:00.293Z
Modified
2026-03-14T14:29:25.503677Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.

References

Affected packages

Git / github.com/openvpn/openvpn

Affected ranges

Type
GIT
Repo
https://github.com/openvpn/openvpn
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8990b218fa9db71714ac42b0095c594e19861320
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
787515cdcd7a510489566306b2c0edc45eb2e389
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
117dadc02d163a3e93c28ef7bd296c8dfa1f6156
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
307abe7b32e951ece58c7964b3fa72536aee6724
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
bb9d4c91c95f245dea87735e4e05661e04931b33
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.3.12"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.3.13"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.3.14"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.1"
        }
    ]
}

Affected versions

v2.*
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1_rc1
v2.1_rc10
v2.1_rc11
v2.1_rc12
v2.1_rc13
v2.1_rc14
v2.1_rc15
v2.1_rc16
v2.1_rc17
v2.1_rc18
v2.1_rc19
v2.1_rc2
v2.1_rc20
v2.1_rc21
v2.1_rc22
v2.1_rc3
v2.1_rc4
v2.1_rc5
v2.1_rc6
v2.1_rc7
v2.1_rc8
v2.1_rc9
v2.2-RC
v2.2-RC2
v2.2-beta4
v2.2-beta5
v2.3-alpha1
v2.3.0
v2.3.1
v2.3.10
v2.3.11
v2.3.12
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
v2.3_alpha2
v2.3_alpha3
v2.3_beta1
v2.3_rc1
v2.3_rc2
v2.4.0
v2.4_alpha1
v2.4_alpha2
v2.4_beta1
v2.4_beta2
v2.4_rc1
v2.4_rc2

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2.4.0-alpha2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2.4.0-beta1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2.4.0-beta2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2.4.0-rc1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2.4.0-rc2"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7478.json"