Improper input validation in OpenVPN for Windows - CVE-2017-7522
Published: June 21, 2017
Vulnerability identifier: #VU7141
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-7522
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an error when processing --x509-track attribute within mbedtls. A remote authenticated attacker can perform denial of service (DoS) attack.
Affected software
OpenVPN for Windows
Amazon Linux AMI
Fedora
Slackware Linux
openvpn
Amazon Linux AMI
Fedora
Slackware Linux
openvpn
How to mitigate CVE-2017-7522
Update OpenVPN to version 2.4.3.
openvpn - addressed in versions 2.3.17-1.fc24, 2.4.3-1.el6, 2.4.3-1.el7, 2.4.3-1.fc25, 2.4.3-1.fc26