---

CVE-2017-7478 - log back

CVE-2017-7478 created at 25 Sep 2019 19:31:40
Severity	+ High
Remote	+ Remote
Type	+ Denial of service
Description	+ A security issue has been found in OpenVPN <= 2.4.1 where an unauthenticated attacker can send a packet with an unexpected payload size during SSL handshake, causing a server shutdown. Servers using tls-auth are protected against this attack as packets with an invalid HMAC are discarded before being processed by the vulnerable code.
References	+ https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits + https://ostif.org/the-openvpn-2-4-0-audit-by-ostif-and-quarkslab-results/ + http://blog.quarkslab.com/security-assessment-of-openvpn.html
Notes