Description
In ACCEL-PPP (an implementation of PPTP/PPPoE/L2TP/SSTP), there is a buffer overflow when receiving an l2tp control packet ith an AVP which type is a string and no hidden flags, length set to less than 6. If your application is used in open networks or there are untrusted nodes in the network it is highly recommended to apply the patch. The problem was patched with commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b As a workaround changes of commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b can be applied to older versions.
References (2)
Core 2
Core References
Third Party Advisory x_refsource_confirm
https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-rr68-fchr-69vf
Patch, Third Party Advisory x_refsource_misc
https://github.com/accel-ppp/accel-ppp/commit/2324bcd5ba12cf28f47357a8f03cd41b7c04c52b
Scores
CVSS v3
8.2
EPSS
0.0046
EPSS Percentile
64.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Details
CWE
CWE-119
CWE-120
Status
published
Products (1)
accel-ppp/accel-ppp
< 1.12.0-92-g38b6104
Published
Sep 09, 2020
Tracked Since
Feb 18, 2026