CVE-2017-12166

NameCVE-2017-12166
DescriptionOpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)
Debian Bugs877089

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
openvpn (PTS)jessie (security), jessie2.3.4-5+deb8u2vulnerable
stretch2.4.0-6+deb9u2vulnerable
stretch (security)2.4.0-6+deb9u1vulnerable
buster, sid2.4.6-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
openvpnsource(unstable)2.4.4-1medium877089

Notes

[stretch] - openvpn <no-dsa> (Minor issue)
[jessie] - openvpn <no-dsa> (Minor issue)
[wheezy] - openvpn <no-dsa> (Minor issue)
https://community.openvpn.net/openvpn/wiki/CVE-2017-12166
http://www.openwall.com/lists/oss-security/2017/09/28/2
https://community.openvpn.net/openvpn/changeset/3b1a61e9fb27213c46f76312f4065816bee8ed01/ (master)
https://community.openvpn.net/openvpn/changeset/c7e259160b28e94e4ea7f0ef767f8134283af255/ (release/2.4)
https://community.openvpn.net/openvpn/changeset/fce34375295151f548a26c2d0eb30141e427c81a/ (release/2.3)
https://community.openvpn.net/openvpn/changeset/a9f5c744d6b09f2495ca48d2c926efd3a4b981e6/ (release/2.2)

Search for package or bug name: Reporting problems