CVE-2023-46849

Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://community.openvpn.net/openvpn/wiki/CVE-2023-46849	Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/	Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/
https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/	Vendor Advisory
https://www.debian.org/security/2023/dsa-5555	Third Party Advisory
https://community.openvpn.net/openvpn/wiki/CVE-2023-46849	Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/	Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/
https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/	Vendor Advisory
https://www.debian.org/security/2023/dsa-5555	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openvpn:openvpn:::::community:::*
	cpe:2.3:a:openvpn:openvpn_access_server::::::::
	cpe:2.3:a:openvpn:openvpn_access_server:2.12.0:::::::*
	cpe:2.3:a:openvpn:openvpn_access_server:2.12.1:::::::*

Configuration 2 (hide)

OR	cpe:2.3:o:debian:debian_linux:12.0:::::::*
	cpe:2.3:o:fedoraproject:fedora:39:::::::*

History

21 Nov 2024, 08:29

Type	Values Removed	Values Added
References	~~() https://community.openvpn.net/openvpn/wiki/CVE-2023-46849 - Vendor Advisory~~	() https://community.openvpn.net/openvpn/wiki/CVE-2023-46849 - Vendor Advisory
References	~~() https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/ - Mailing List~~	() https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/ - Mailing List
References	~~() https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/ -~~	() https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/ -
References	~~() https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/ - Vendor Advisory~~	() https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/ - Vendor Advisory
References	~~() https://www.debian.org/security/2023/dsa-5555 - Third Party Advisory~~	() https://www.debian.org/security/2023/dsa-5555 - Third Party Advisory

29 Nov 2023, 03:15

Type	Values Removed	Values Added
References		() https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/ -

28 Nov 2023, 19:47

Type	Values Removed	Values Added
CWE		CWE-369
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
First Time		Fedoraproject fedora Fedoraproject Openvpn openvpn Access Server Openvpn Openvpn openvpn Debian Debian debian Linux
CPE		cpe:2.3:a:openvpn:openvpn_access_server:2.12.0:::::::* cpe:2.3:o:fedoraproject:fedora:39:::::::* cpe:2.3:o:debian:debian_linux:12.0:::::::* cpe:2.3:a:openvpn:openvpn_access_server:2.12.1:::::::* cpe:2.3:a:openvpn:openvpn:::::community:::* cpe:2.3:a:openvpn:openvpn_access_server::::::::
References	~~() https://community.openvpn.net/openvpn/wiki/CVE-2023-46849 -~~	() https://community.openvpn.net/openvpn/wiki/CVE-2023-46849 - Vendor Advisory
References	~~() https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/ -~~	() https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/ - Mailing List
References	~~() https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/ -~~	() https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/ - Vendor Advisory
References	~~() https://www.debian.org/security/2023/dsa-5555 -~~	() https://www.debian.org/security/2023/dsa-5555 - Third Party Advisory

23 Nov 2023, 03:15

Type	Values Removed	Values Added
References		() https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/ -

16 Nov 2023, 02:15

Type	Values Removed	Values Added
References		() https://www.debian.org/security/2023/dsa-5555 -

11 Nov 2023, 01:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-11-11 01:15

Updated : 2024-11-21 08:29

NVD link : CVE-2023-46849

Mitre link : CVE-2023-46849

CVE.ORG link : CVE-2023-46849

JSON object : View

Products Affected

openvpn

openvpn
openvpn_access_server

fedoraproject

fedora

debian

debian_linux

CWE

CWE-369

Divide By Zero

7.5 /10