PublicDateAtUSN: 2017-06-21
Candidate: CVE-2017-7508
PublicDate: 2017-06-27 13:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7508
 http://www.openwall.com/lists/oss-security/2017/06/21/6
 https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243
 https://ubuntu.com/security/notices/USN-3339-1
Description:
 OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote
 denial-of-service when receiving malformed IPv6 packet.
Ubuntu-Description:
Notes:
 leosilva> same as debian wheezy for precise-esm it's not affected
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=865480
Priority: medium
Discovered-by: Guido Vranken
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]

Patches_openvpn:
 upstream: https://github.com/OpenVPN/openvpn/commit/c3f47077a7 (master)
 upstream: https://github.com/OpenVPN/openvpn/commit/ed28cde3d8 (2.4)
 upstream: https://github.com/OpenVPN/openvpn/commit/fc61d1bda1 (2.3)
upstream_openvpn: released (2.4.3, 2.3.17)
precise/esm_openvpn: not-affected (code not present)
trusty_openvpn: released (2.3.2-7ubuntu3.2)
trusty/esm_openvpn: released (2.3.2-7ubuntu3.2)
vivid/ubuntu-core_openvpn: DNE
xenial_openvpn: released (2.3.10-1ubuntu2.1)
esm-infra/xenial_openvpn: released (2.3.10-1ubuntu2.1)
yakkety_openvpn: released (2.3.11-1ubuntu2.1)
zesty_openvpn: released (2.4.0-4ubuntu1.3)
artful_openvpn: released (2.4.0-5ubuntu2)
devel_openvpn: released (2.4.0-5ubuntu2)