ALT-PU-2017-1606

Высокий

ALT-PU-2017-1606: package openvpn update to version 2.4.2-alt1

Источник

errata.altlinux.org

Дата публикации

15.05.2017

Дата обновления

15.05.2017

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades openvpn to version 2.4.2-alt1.

Устраненные уязвимости2

CVE-2017-7478

Высокий 7.5

Дата публикации: 15.05.2017

CWE-20

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.

CVSS 3.0

Высокий 7.5

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS 2.0

Средний 5

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access vector: Network
Complexity: Low
Authentication: None
Confidentiality: None
Integrity: None
Availability: Partial

Ссылки

CVE-2017-7478 https://nvd.nist.gov/vuln/detail/CVE-2017-7478

Ссылки1

ALT-PU-2017-1606 https://errata.altlinux.org/ALT-PU-2017-1606

Связанные уязвимости

openSUSE-SU-2017:1638-1

suse-cvrf

больше 9 лет назад

Security update for openvpn

SUSE-SU-2017:1622-1

suse-cvrf

больше 9 лет назад

Security update for openvpn

SUSE-SU-2017:2838-1

suse-cvrf

около 9 лет назад

Security update for openvpn

SUSE-SU-2017:1718-1

suse-cvrf

больше 9 лет назад

Security update for openvpn-openssl1

CVE-2017-7479

CVSS3: 6.5

ubuntu

больше 9 лет назад

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.