CVE-2017-12166
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to ...
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Amazon (mittel), Ubuntu (niedrig).
Beschreibung
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 1 | openvpn, openvpn-debuginfo, openvpn-devel | 2.4.4-1.21.amzn1 |
| debian 11 | openvpn | 2.4.4-1 |
| debian 12 | openvpn | 2.4.4-1 |
| debian 13 | openvpn | 2.4.4-1 |
| debian 14 | openvpn | 2.4.4-1 |
| debian 7 | openvpn | kein Fix angegeben |
| debian 8 | openvpn | kein Fix angegeben |
| debian 9 | openvpn | 2.4.0-6+deb9u4 |
| echo | openvpn | 2.4.4-1 |
| ubuntu 16.04-ESM | openvpn | 2.3.10-1ubuntu2.2+esm2 |
Alle 12 Einträge aus 10 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 1 | openvpn | 2.4.4-1.21.amzn1 |
| amazon linux 1 | openvpn-debuginfo | 2.4.4-1.21.amzn1 |
| amazon linux 1 | openvpn-devel | 2.4.4-1.21.amzn1 |
| debian 11 | openvpn | 2.4.4-1 |
| debian 12 | openvpn | 2.4.4-1 |
| debian 13 | openvpn | 2.4.4-1 |
| debian 14 | openvpn | 2.4.4-1 |
| debian 7 | openvpn | kein Fix angegeben |
| debian 8 | openvpn | kein Fix angegeben |
| debian 9 | openvpn | 2.4.0-6+deb9u4 |
| echo | openvpn | 2.4.4-1 |
| ubuntu 16.04-ESM | openvpn | 2.3.10-1ubuntu2.2+esm2 |
Referenzen
- http://www.openwall.com/lists/oss-security/2017/09/28/2
- http://www.securityfocus.com/bid/101153
- http://www.securitytracker.com/id/1039470
- https://community.openvpn.net/openvpn/wiki/CVE-2017-12166
- https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html
- https://ubuntu.com/security/notices/USN-7340-1
- https://www.cve.org/CVERecord?id=CVE-2017-12166