CVE catalog

CVE-2017-7508

openvpn: CVE-2017-7508

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
4.76% · Oct 25, 2026

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopenvpnsid2.7.8-1fixed
Debianopenvpnforky2.7.8-1fixed
Debianopenvpntrixie2.6.14-1+deb13u3fixed
Debianopenvpntrixie-security2.6.14-1+deb13u3fixed
Debianopenvpnbookworm2.6.14-0+deb12u2fixed
Debianopenvpnbookworm-security2.6.14-0+deb12u2fixed
Ubuntuopenvpn14.042.3.2-4ubuntu1vulnerable
Ubuntuopenvpn14.042.3.2-5ubuntu1vulnerable
Ubuntuopenvpn14.042.3.2-7ubuntu1vulnerable
Ubuntuopenvpn14.042.3.2-7ubuntu2vulnerable
Ubuntuopenvpn14.042.3.2-7ubuntu3vulnerable
Ubuntuopenvpn14.042.3.2-7ubuntu3.1vulnerable
Ubuntuopenvpn14.042.3.2-7ubuntu3.2fixed
Ubuntuopenvpn16.042.3.7-1ubuntu1vulnerable
Ubuntuopenvpn16.042.3.7-2ubuntu1vulnerable
Ubuntuopenvpn16.042.3.8-1ubuntu1vulnerable
Ubuntuopenvpn16.042.3.10-1ubuntu1vulnerable
Ubuntuopenvpn16.042.3.10-1ubuntu2vulnerable
Ubuntuopenvpn16.042.3.10-1ubuntu2.1fixed
Suseopenvpnlinux enterprise point of sale 11 sp32.0.9-143.46.1fixed
Suseopenvpnlinux enterprise server 11 sp3-ltss2.0.9-143.46.1fixed
Suseopenvpnlinux enterprise server 11 sp3-teradata2.0.9-143.46.1fixed
Suseopenvpnlinux enterprise server 11 sp42.0.9-143.46.1fixed
Suseopenvpnlinux enterprise server for sap applications 11 sp42.0.9-143.46.1fixed
Suseopenvpnopenstack cloud 62.3.8-16.17.1fixed
Suseopenvpnlinux enterprise desktop 12 sp22.3.8-16.17.1fixed
Suseopenvpnlinux enterprise server for raspberry pi 12 sp22.3.8-16.17.1fixed
Suseopenvpnlinux enterprise server for sap applications 122.3.8-16.17.1fixed
Suseopenvpnlinux enterprise server for sap applications 12 sp12.3.8-16.17.1fixed
Suseopenvpnlinux enterprise server 12-ltss2.3.8-16.17.1fixed
Suseopenvpnlinux enterprise server 12 sp1-ltss2.3.8-16.17.1fixed
Suseopenvpnlinux enterprise server 12 sp22.3.8-16.17.1fixed
Suseopenvpnlinux enterprise server for sap applications 12 sp22.3.8-16.17.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianopenvpnsourcesid2.4.3-1not yet assignedNot reported[865480]
Debianopenvpnsourceforky2.4.3-1not yet assignedNot reported[865480]
Debianopenvpnsourcetrixie2.4.3-1not yet assignedNot reported[865480]
Debianopenvpnsourcebookworm2.4.3-1not yet assignedNot reported[865480]
Ubuntuopenvpndeb14.042.3.2-7ubuntu3.2Not reportedUBUNTU-CVE-2017-7508Not reported
Ubuntuopenvpndeb16.042.3.10-1ubuntu2.1Not reportedUBUNTU-CVE-2017-7508Not reported
Suseopenvpnrpmlinux enterprise point of sale 11 sp32.0.9-143.46.1Not reportedSUSE-SU-2017:1642-1Not reported
Suseopenvpnrpmlinux enterprise server 11 sp3-ltss2.0.9-143.46.1Not reportedSUSE-SU-2017:1642-1Not reported
Suseopenvpnrpmlinux enterprise server 11 sp3-teradata2.0.9-143.46.1Not reportedSUSE-SU-2017:1642-1Not reported
Suseopenvpnrpmlinux enterprise server 11 sp42.0.9-143.46.1Not reportedSUSE-SU-2017:1642-1Not reported
Suseopenvpnrpmlinux enterprise server for sap applications 11 sp42.0.9-143.46.1Not reportedSUSE-SU-2017:1642-1Not reported
Suseopenvpnrpmopenstack cloud 62.3.8-16.17.1Not reportedSUSE-SU-2017:1635-1Not reported
Suseopenvpnrpmlinux enterprise desktop 12 sp22.3.8-16.17.1Not reportedSUSE-SU-2017:1635-1Not reported
Suseopenvpnrpmlinux enterprise server for raspberry pi 12 sp22.3.8-16.17.1Not reportedSUSE-SU-2017:1635-1Not reported
Suseopenvpnrpmlinux enterprise server for sap applications 122.3.8-16.17.1Not reportedSUSE-SU-2017:1635-1Not reported
Suseopenvpnrpmlinux enterprise server for sap applications 12 sp12.3.8-16.17.1Not reportedSUSE-SU-2017:1635-1Not reported
Suseopenvpnrpmlinux enterprise server 12-ltss2.3.8-16.17.1Not reportedSUSE-SU-2017:1635-1Not reported
Suseopenvpnrpmlinux enterprise server 12 sp1-ltss2.3.8-16.17.1Not reportedSUSE-SU-2017:1635-1Not reported
Suseopenvpnrpmlinux enterprise server 12 sp22.3.8-16.17.1Not reportedSUSE-SU-2017:1635-1Not reported
Suseopenvpnrpmlinux enterprise server for sap applications 12 sp22.3.8-16.17.1Not reportedSUSE-SU-2017:1635-1Not reported

[Debian bug #865480]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [openvpn]Unknown
    Details (4)

    • 2.6.14-0+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.4.3-1

      dsa · openvpn · debian · bookworm; dsa · openvpn · debian · 12

    • 2.6.14-0+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.4.3-1

      dsa · openvpn · debian · bookworm; dsa · openvpn · debian · 12

    • 2.6.14-0+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 2.4.3-1

      dsa · openvpn · debian · bookworm; dsa · openvpn · debian · 12

    • 2.6.14-0+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 2.4.3-1

      dsa · openvpn · debian · bookworm; dsa · openvpn · debian · 12

[Debian 13 (Trixie)]

  • [openvpn]Unknown
    Details (6)

    • 2.6.14-1+deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.4.3-1

      dsa · openvpn · debian · 13

    • 2.6.14-1+deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.4.3-1

      dsa · openvpn · debian · 13

    • 2.7.5-1~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 2.4.3-1

      dsa · openvpn · debian · 13

    • 2.7.5-1~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 2.4.3-1

      dsa · openvpn · debian · 13

    • 2.6.14-1+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 2.4.3-1

      dsa · openvpn · debian · 13

    • 2.6.14-1+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 2.4.3-1

      dsa · openvpn · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]