PublicDateAtUSN: 2017-06-21
Candidate: CVE-2017-7520
PublicDate: 2017-06-27 13:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7520
 https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243
 http://www.openwall.com/lists/oss-security/2017/06/21/6
 https://ubuntu.com/security/notices/USN-3339-1
 https://ubuntu.com/security/notices/USN-3339-2
Description:
 OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to
 denial-of-service and/or possibly sensitive memory leak triggered by
 man-in-the-middle attacker.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=865480
Priority: medium
Discovered-by: Guido Vranken
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H [7.4 HIGH]

Patches_openvpn:
 upstream: https://github.com/OpenVPN/openvpn/commit/7718c8984f (master)
 upstream: https://github.com/OpenVPN/openvpn/commit/043fe32787 (2.4)
 upstream: https://github.com/OpenVPN/openvpn/commit/f38a4a1059 (2.3)
 upstream: https://github.com/OpenVPN/openvpn/commit/4bec9d25d5 (2.2)
upstream_openvpn: released (2.4.3, 2.3.17)
precise/esm_openvpn: released (2.2.1-8ubuntu1.5)
trusty_openvpn: released (2.3.2-7ubuntu3.2)
trusty/esm_openvpn: released (2.3.2-7ubuntu3.2)
vivid/ubuntu-core_openvpn: DNE
xenial_openvpn: released (2.3.10-1ubuntu2.1)
esm-infra/xenial_openvpn: released (2.3.10-1ubuntu2.1)
yakkety_openvpn: released (2.3.11-1ubuntu2.1)
zesty_openvpn: released (2.4.0-4ubuntu1.3)
devel_openvpn: released (2.4.0-5ubuntu2)