Lucene search

K
slackwareSlackware Linux ProjectSSA-2017-172-01
HistoryJun 21, 2017 - 6:40 p.m.

[slackware-security] openvpn

2017-06-2118:40:28
Slackware Linux Project
www.slackware.com
15

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.017 Low

EPSS

Percentile

87.7%

New openvpn packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1,
14.2, and -current to fix security issues.

Here are the details from the Slackware 14.2 ChangeLog:

patches/packages/openvpn-2.3.17-i586-1_slack14.2.txz: Upgraded.
This update fixes several denial of service issues discovered
by Guido Vranken.
For more information, see:
https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243
https://vulners.com/cve/CVE-2017-7508
https://vulners.com/cve/CVE-2017-7520
https://vulners.com/cve/CVE-2017-7521
https://vulners.com/cve/CVE-2017-7512
https://vulners.com/cve/CVE-2017-7522
(* Security fix *)

Where to find the new packages:

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the “Get Slack” section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/openvpn-2.3.17-i486-1_slack13.0.txz

Updated package for Slackware x86_64 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/openvpn-2.3.17-x86_64-1_slack13.0.txz

Updated package for Slackware 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/openvpn-2.3.17-i486-1_slack13.1.txz

Updated package for Slackware x86_64 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/openvpn-2.3.17-x86_64-1_slack13.1.txz

Updated package for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/openvpn-2.3.17-i486-1_slack13.37.txz

Updated package for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/openvpn-2.3.17-x86_64-1_slack13.37.txz

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/openvpn-2.3.17-i486-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/openvpn-2.3.17-x86_64-1_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/openvpn-2.3.17-i486-1_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/openvpn-2.3.17-x86_64-1_slack14.1.txz

Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/openvpn-2.3.17-i586-1_slack14.2.txz

Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/openvpn-2.3.17-x86_64-1_slack14.2.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openvpn-2.4.3-i586-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/openvpn-2.4.3-x86_64-1.txz

MD5 signatures:

Slackware 13.0 package:
326003ba4359c994d9d9451d8c811a7c openvpn-2.3.17-i486-1_slack13.0.txz

Slackware x86_64 13.0 package:
38d3e975bd173066d417c00817b1926f openvpn-2.3.17-x86_64-1_slack13.0.txz

Slackware 13.1 package:
9d90bff4b3934035000e0a637dcd5870 openvpn-2.3.17-i486-1_slack13.1.txz

Slackware x86_64 13.1 package:
bf3e8104d8f53c2a5cabbde3cd1175f3 openvpn-2.3.17-x86_64-1_slack13.1.txz

Slackware 13.37 package:
4394a24fc1745b619a6d640da18a17df openvpn-2.3.17-i486-1_slack13.37.txz

Slackware x86_64 13.37 package:
7231d5dc636ccf47fca8fb60d92c6e9c openvpn-2.3.17-x86_64-1_slack13.37.txz

Slackware 14.0 package:
37a195492c74384fa7a95f9b8c5d528d openvpn-2.3.17-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
dc3a2cdf61c2b1d796ed0663f9deeb77 openvpn-2.3.17-x86_64-1_slack14.0.txz

Slackware 14.1 package:
601bfdb72e6fef2a0d8108ea33f5cf5d openvpn-2.3.17-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
6329704b8a952f3de8b64fe3b294d5ab openvpn-2.3.17-x86_64-1_slack14.1.txz

Slackware 14.2 package:
0d4cb74aab8225c1967f37c9e1bff8f4 openvpn-2.3.17-i586-1_slack14.2.txz

Slackware x86_64 14.2 package:
f70fdb325b03da7b18bcfadda367e7b9 openvpn-2.3.17-x86_64-1_slack14.2.txz

Slackware -current package:
e8aec8c39f95837fd4632167e7844a65 n/openvpn-2.4.3-i586-1.txz

Slackware x86_64 -current package:
b580604ff3b78acd74805c41d4c2bcc8 n/openvpn-2.4.3-x86_64-1.txz

Installation instructions:

Upgrade the package as root:
> upgradepkg openvpn-2.3.17-i586-1_slack14.2.txz

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.017 Low

EPSS

Percentile

87.7%