CVE-2017-7521

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issue in extract_x509_extension().

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-415 CWE-772

Affected software

Vendor	Product	Versions
OpenVPN Technologies, Inc	OpenVPN	before 2.4.3; before 2.3.17

References

http://www.debian.org/security/2017/dsa-3900
http://www.securityfocus.com/bid/99230Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038768
https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243Vendor Advisory
http://www.debian.org/security/2017/dsa-3900
http://www.securityfocus.com/bid/99230Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038768
https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243Vendor Advisory

Timeline

Published: Jun 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-75226.5OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certifica CVE-2017-75237.5Cygwin versions 1.7.2 up to and including 1.8.0 are vulnerable to buffer overflow vulnerability in wcsxfrm/wcsxfrm_l functions resulting int CVE-2017-75247.5tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when gene CVE-2017-75259.8A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthentica CVE-2017-75266.8libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left CVE-2017-75286.5Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For head CVE-2017-75297.5Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resultin CVE-2017-75308.8In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbit CVE-2017-75314.3In Moodle 3.3, the course overview block reveals activities in hidden courses.CVE-2017-75326.5In Moodle 3.x, course creators are able to change system default settings for courses.CVE-2017-75337.0Race condition in the fsnotify implementation in the Linux kernel through 4.12.4 allows local users to gain privileges or cause a denial of CVE-2017-75345.4OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods. The flaw is due to lack of sanitation of user in