CVE-2017-12166

Critical

Published: 04/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.

Risk Assessment

Exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely, posing a significant security risk to systems using OpenVPN.

Recommendation

It is recommended to upgrade OpenVPN to version 2.3.3 or 2.4.4 and later to mitigate this vulnerability.

Original NVD description (English source)

OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.