Karthikeyan Bhargavan and Gaëtan Leurent discovered that 64-bit block ciphers are vulnerable to a birthday attack. A remote attacker could possibly use this issue to recover cleartext data. Fixing this issue requires a configuration change to switch to a different cipher. This update adds a warning to the log file when a 64-bit block cipher is in use. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-6329)
It was discovered that OpenVPN incorrectly handled rollover of packet ids. An authenticated remote attacker could use this issue to cause OpenVPN to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2017-7479)
Guido Vranken discovered that OpenVPN incorrectly handled certain malformed IPv6 packets. A remote attacker could use this issue to cause OpenVPN to crash, resulting in a denial of service. (CVE-2017-7508)
Guido Vranken discovered that OpenVPN incorrectly handled an HTTP proxy with NTLM authentication. A remote attacker could use this issue to cause OpenVPN clients to crash, resulting in a denial of service, or possibly expose sensitive memory contents. (CVE-2017-7520)
Guido Vranken discovered that OpenVPN incorrectly handled certain x509 extensions. A remote attacker could use this issue to cause OpenVPN to crash, resulting in a denial of service. (CVE-2017-7521)
{ "availability": "No subscription required", "binaries": [ { "binary_version": "2.3.2-7ubuntu3.2", "binary_name": "openvpn" } ] }
{ "cves_map": { "cves": [ { "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "type": "Ubuntu", "score": "low" } ], "id": "CVE-2016-6329" }, { "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "type": "Ubuntu", "score": "low" } ], "id": "CVE-2017-7479" }, { "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "type": "Ubuntu", "score": "medium" } ], "id": "CVE-2017-7508" }, { "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "type": "Ubuntu", "score": "medium" } ], "id": "CVE-2017-7520" }, { "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "type": "Ubuntu", "score": "medium" } ], "id": "CVE-2017-7521" } ], "ecosystem": "Ubuntu:14.04:LTS" } }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "2.3.10-1ubuntu2.1", "binary_name": "openvpn" } ] }
{ "cves_map": { "cves": [ { "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "type": "Ubuntu", "score": "low" } ], "id": "CVE-2016-6329" }, { "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "type": "Ubuntu", "score": "low" } ], "id": "CVE-2017-7479" }, { "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "type": "Ubuntu", "score": "medium" } ], "id": "CVE-2017-7508" }, { "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "type": "Ubuntu", "score": "medium" } ], "id": "CVE-2017-7520" }, { "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "type": "Ubuntu", "score": "medium" } ], "id": "CVE-2017-7521" } ], "ecosystem": "Ubuntu:16.04:LTS" } }