description: Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.
problem types: CWE-369 Divide By Zero
affected:
{
vendor: OpenVPN
product: OpenVPN 2 (Community)
versions:
status: affected, version: 2.6.0, lessThanOrEqual: 2.6.6, versionType: minor release
defaultStatus: unaffected
}
{
vendor: OpenVPN
product: Access Server
platforms: Linux
versions:
status: affected, version: 2.11.0, lessThanOrEqual: 2.11.3, versionType: patch release
status: affected, version: 2.12.0, lessThanOrEqual: 2.12.1, versionType: patch release
defaultStatus: unaffected
}
