Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2023-46849

Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
OpenVPN

Description

Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenVPN OpenVPN 2 (Community)

Default version status: unaffected

  • 2.6.0 to ≤ 2.6.6affected

OpenVPN Access Server

Default version status: unaffected

  • 2.11.0 to ≤ 2.11.3affected
  • 2.12.0 to ≤ 2.12.1affected

References