{"id":"CVE-2017-12166","aliases":["CLSA-2025-1742577500","DEBIAN-CVE-2017-12166","DLA-2992-1","EUVD-2017-3742","GHSA-vffw-rxx6-r4pj","MGASA-2017-0372","SUSE-SU-2017:2838-1","SUSE-SU-2017:2839-1","SUSE-SU-2017:3177-1","UBUNTU-CVE-2017-12166","USN-7340-1","openSUSE-SU-2024:11128-1"],"status":"published","title":"OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow...","description":"OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03629,"percentile":0.89613,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-787"],"published":"2017-10-03T19:00:00Z","modified":"2026-10-24T10:30:44Z","fixes":[{"ecosystem":"TuxCare:Ubuntu:16.04","package":"openvpn","fixed_in":["2.3.10-1ubuntu2.2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openvpn","fixed_in":["2.4.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openvpn","fixed_in":["2.4.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openvpn","fixed_in":["2.4.4-1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"openvpn","fixed_in":["2.3.18-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"openvpn","fixed_in":["2.4.4-1.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 6","package":"openvpn","fixed_in":["2.3.8-16.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"openvpn","fixed_in":["2.3.8-16.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openvpn","fixed_in":["2.3.8-16.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"openvpn","fixed_in":["2.3.8-16.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openvpn","fixed_in":["2.3.8-16.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openvpn","fixed_in":["2.3.8-16.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openvpn","fixed_in":["2.3.8-16.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"openvpn","fixed_in":["2.3.8-16.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openvpn","fixed_in":["2.3.8-16.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openvpn","fixed_in":["2.3.8-16.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openvpn","fixed_in":["2.3.8-16.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"openvpn-openssl1","fixed_in":["2.3.2-0.10.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openvpn","fixed_in":["2.3.2-7ubuntu3.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openvpn","fixed_in":["2.3.10-1ubuntu2.2+esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.10-1ubuntu2.2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-6+deb9u4"}]}],"versions":["2.4.0-6","2.4.0-6+deb9u1","2.4.0-6+deb9u1~bpo8+1","2.4.0-6+deb9u2","2.4.0-6+deb9u3"],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.18-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-1.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-143.47.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-143.47.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-143.47.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-143.47.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-143.47.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-16.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-16.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-16.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-16.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-16.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-16.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-16.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-16.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-16.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-16.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-16.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"openvpn-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-0.10.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-7ubuntu3.2+esm2"}]}],"versions":["2.3.2-4ubuntu1","2.3.2-5ubuntu1","2.3.2-7ubuntu1","2.3.2-7ubuntu2","2.3.2-7ubuntu3","2.3.2-7ubuntu3.1","2.3.2-7ubuntu3.2","2.3.2-7ubuntu3.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.10-1ubuntu2.2+esm2"}]}],"versions":["2.3.7-1ubuntu1","2.3.7-2ubuntu1","2.3.8-1ubuntu1","2.3.10-1ubuntu1","2.3.10-1ubuntu2","2.3.10-1ubuntu2.1","2.3.10-1ubuntu2.2","2.3.10-1ubuntu2.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-7ubuntu3.2+esm2"}]}],"versions":["2.3.2-4ubuntu1","2.3.2-5ubuntu1","2.3.2-7ubuntu1","2.3.2-7ubuntu2","2.3.2-7ubuntu3","2.3.2-7ubuntu3.1","2.3.2-7ubuntu3.2","2.3.2-7ubuntu3.2+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.10-1ubuntu2.2+esm2"}]}],"versions":["2.3.7-1ubuntu1","2.3.7-2ubuntu1","2.3.8-1ubuntu1","2.3.10-1ubuntu1","2.3.10-1ubuntu2","2.3.10-1ubuntu2.1","2.3.10-1ubuntu2.2","2.3.10-1ubuntu2.2+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-2ubuntu1.7+esm1"}]}],"versions":["2.4.3-4ubuntu1","2.4.4-1ubuntu1","2.4.4-2ubuntu1","2.4.4-2ubuntu1.1","2.4.4-2ubuntu1.2","2.4.4-2ubuntu1.3","2.4.4-2ubuntu1.5","2.4.4-2ubuntu1.6","2.4.4-2ubuntu1.7"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.3-1.2"}]}],"bundled":10}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"openvpn","product":"openvpn"}],"references":[{"url":"https://community.openvpn.net/openvpn/wiki/CVE-2017-12166","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","advisory","report"]},{"url":"http://www.securityfocus.com/bid/101153","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","URL Repurposed","advisory"]},{"url":"http://www.securitytracker.com/id/1039470","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","URL Repurposed","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12166"},{"url":"https://github.com/advisories/GHSA-vffw-rxx6-r4pj"},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2025-1742577500.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-12166","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0372.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21780","tags":["report"]},{"url":"https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23","tags":["web"]},{"url":"https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172838-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1038709","tags":["report"]},{"url":"https://bugzilla.suse.com/1038711","tags":["report"]},{"url":"https://bugzilla.suse.com/1038713","tags":["report"]},{"url":"https://bugzilla.suse.com/1060877","tags":["report"]},{"url":"https://bugzilla.suse.com/995374","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7479","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172839-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173177-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-12166","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/09/28/2","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12166","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7340-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-5594","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2005-3393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2005-3409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-4339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15078","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-12166","description":"OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.","status":"published","published":"2017-10-03T19:00:00Z","modified":"2024-08-05T18:28:16.53Z","updated_at":"2026-11-02T14:33:17.264801Z"}],"euvd":[{"id":"EUVD-2017-3742","description":"OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.","status":"published","published":"2017-10-03T19:00:00Z","modified":"2024-08-05T18:28:16Z","updated_at":"2026-11-03T02:23:22.23661Z"}],"ghsa":[{"id":"GHSA-vffw-rxx6-r4pj","title":"OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow...","description":"OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.","status":"published","published":"2022-05-04T00:02:17Z","modified":"2023-02-01T05:01:30Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T14:49:44.320253Z"}],"nvd":[{"id":"CVE-2017-12166","description":"OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.","status":"published","published":"2017-10-04T01:29:02.09Z","modified":"2026-06-17T01:02:48.463Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:04:01.734197Z"}],"osv":[{"id":"CVE-2017-12166","description":"OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.","status":"published","published":"2017-10-04T01:29:02.09Z","modified":"2026-10-24T10:30:44.31896899Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:04.159616Z"},{"id":"DEBIAN-CVE-2017-12166","description":"OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.","status":"published","published":"2017-10-04T01:29:02.09Z","modified":"2026-09-01T20:03:42.010981789Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"UBUNTU-CVE-2017-12166","description":"OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.","status":"published","published":"2017-10-04T01:29:00Z","modified":"2026-02-04T02:50:22.486392Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"CLSA-2025-1742577500","title":"Fix CVE(s): CVE-2017-12166","description":"   * SECURITY UPDATE: Possible inject of arbitrary data into third-party\n     executables or plug-ins\n     - debian/patches/CVE-2017-12166.patch: Fix an out-of-bounds issue preventing\n       potential stack overflow\n     - CVE-2017-12166\n   * UPDATE CERTIFICATES: Renew sample keys\n     - debian/patches/sample-keys-renew.patch: Renew sample keys for 10 years","status":"published","published":"2025-03-21T17:18:27Z","modified":"2026-06-04T10:03:39.620392Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"DLA-2992-1","title":"openvpn - security update","status":"published","published":"2022-05-03T00:00:00Z","modified":"2026-03-09T01:20:24.861872Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2017-0372","title":"Updated openvpn packages fix security vulnerability","description":"The bounds check in read_key() was performed after using the value, instead\nof before. If 'key-method 1' is used, this allowed an attacker to send a\nmalformed packet to trigger a stack buffer overflow. Note that 'key-method 1'\nhas been replaced by 'key method 2' as the default in OpenVPN 2.0\n(CVE-2017-12166).\n","status":"published","published":"2017-10-18T20:19:34Z","modified":"2026-04-16T06:26:31.682270232Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:11128-1","title":"openvpn-2.5.3-1.2 on GA media","description":"These are all security issues fixed in the openvpn-2.5.3-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:53:06.953443Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2017:2838-1","title":"Security update for openvpn","description":"\n\nThis update for openvpn fixes the following security issues:\n\n- CVE-2017-12166: OpenVPN was vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution. (bsc#1060877).\n- CVE-2016-6329: Now show which ciphers should no longer be used in openvpn --show-ciphers to avoid the SWEET32 attack (bsc#995374)\n- CVE-2017-7478: OpenVPN was vulnerable to unauthenticated Denial of Service of server via received large control packet. (bsc#1038709)\n- CVE-2017-7479: OpenVPN was vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker. (bsc#1038711)\n- Some other hardening fixes have also been applied (bsc#1038713)\n","status":"published","published":"2017-10-24T09:59:40Z","modified":"2026-02-04T03:53:27.509319Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2839-1","title":"Security update for openvpn","description":"This update for openvpn fixes the following issues:\n\n- CVE-2017-12166: Lack of bound check in read_key in old legacy key handling before using values could be used for a remote buffer overflow (bsc#1060877).\n","status":"published","published":"2017-10-24T08:46:40Z","modified":"2026-02-04T04:28:35.133441Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:3177-1","title":"Security update for openvpn-openssl1","description":"This update for openvpn-openssl1 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2017-12166: Fix remote buffer overflow (bsc#1060877).\n","status":"published","published":"2017-12-01T14:03:53Z","modified":"2026-02-04T03:08:09.083778Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-7340-1","title":"openvpn vulnerabilities","description":"It was discovered that OpenVPN did not perform proper input validation\nwhen generating a TLS key under certain configuration, which could lead to\na buffer overflow. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code. This issue only affected\nUbuntu 14.04 LTS, Ubuntu 16.04 LTS. (CVE-2017-12166)\n\nReynir Björnsson discovered that OpenVPN incorrectly handled certain\ncontrol channel messages with nonprintable characters. A remote attacker\ncould possibly use this issue to cause OpenVPN to consume resources, or\nfill up log files with garbage, leading to a denial of service.\n(CVE-2024-5594)\n","status":"published","published":"2025-03-11T03:13:12Z","modified":"2026-06-25T13:31:46.020612429Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}