Changes between Initial Version and Version 1 of CVE-2023-6247


Ignore:
Timestamp:
02/20/24 18:38:35 (7 months ago)
Author:
David Sommerseth
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • CVE-2023-6247

    v1 v1  
     1= CVE-2023-6247: PKCS!#7 parser can result in NULL-dereference
     2
     3The PKCS!#7 parser in OpenVPN 3 Core Library versions through 3.8.3 did not properly validate the parsed data, which would result in the application crashing.
     4
     5This is resolved in OpenVPN 3 Core Library version 3.8.4.
     6
     7=== Note
     8
     9The code paths this issue is related to is never used for OpenVPN connections.  The related code is only used in some of the AWS API support functionality present in the library.
     10
     11=== References
     12
     13MITRE CVE Record: https://www.cve.org/CVERecord?id=CVE-2023-6247
     14OpenVPN 3 Core commit: https://github.com/OpenVPN/openvpn3/commit/afdfe1bb3f4c54e8794
     15Reported by: Bahaa Naamneh