From patchwork Sun Sep 13 17:12:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10218 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4hjZcF20gxz3xTP for ; Sun, 13 Sep 2026 17:13:17 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hjZcD6ngBz5gC for ; Sun, 13 Sep 2026 17:13:16 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hjZbl2CdJz37d2 for ; Sun, 13 Sep 2026 17:12:51 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hjZbc1BXgz377s for ; Sun, 13 Sep 2026 17:12:44 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hjZbX5wFsz8lv; Sun, 13 Sep 2026 17:12:40 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1789319560; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jRze7Im7oLKowUQMWG5lWyD8kEwxuW1N40cWeNYuiCA=; b=+vCPn1Ow/qowo6I1vYKGY7+/6wwMWAwb5azTbOzJ4H5aYVyj3PHjgv5BmRhYL8YGZ1uubJ 8p/qc5b+Pen40qBg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1789319560; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jRze7Im7oLKowUQMWG5lWyD8kEwxuW1N40cWeNYuiCA=; b=p9hMOzafFRc5v6M9MgzSdzjaMaAjBdhHeHwtGnKvPZi7UKYWiax9CQs2Af8EzAAmurwm2f CBEXhS7JtGdPXIn/bjGL2UwWzKixJvqnfbY7iaHM9LSPAl5OU1sSqMUc+lboki9Ar8fJ6U nTVGw5A4WqqNihmgpsGjMVQ0yC5WZRwJDgvYGmPP4mIl7HcrCZk3ZH8QO7qJHtzXMiTPgv ZHyOs4yZJdzek6VFsQc20Nlt1BN2bhItSwWdsvpruL3uXKqkqZEFf6D9WuqweYAoyJcJLR D+TmTcc0GWIAEqJ9PpePBiWx2nmFyX9BntWk8zic/60NdjVFkWe9lp+0KaOqgQ== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] openvpn: Update to version 2.7.7 Date: Sun, 13 Sep 2026 19:12:23 +0200 Message-ID: <20260913171230.3920551-24-adolf.belka@ipfire.org> In-Reply-To: <20260913171230.3920551-1-adolf.belka@ipfire.org> References: <20260913171230.3920551-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 2.7.6 to 2.7.7 - No change in rootfile - 10 CVE fixes - Changelog 2.7.7 Security fixes reliability layer: Avoid unbounded reliable TLS timeout (CVE-2026-84732) reliability layer: Ignore acks for packets that cannot be outstanding (CVE-2026-84732) (both reliability layer bugs found by Mark Bregman , tracked in Github: OpenVPN/openvpn-private-issues#161) Windows: fix CreateProcess() command line quoting for characters that are special to cmd.exe and where a combination of validation script plus rogue CA could lead to misbehavior (CVE-2026-84256) (Bug found by Clouditera Security , tracked in Github: OpenVPN/openvpn-private-issues#159) Windows: fix tapctl to always call netsh.exe with full path (as we do elsewhere) (CVE-2026-84226) (Bug found by BreachX Zero Day Labs, using Typhon AI Mil v2, tracked in Github: OpenVPN/openvpn-private-issues#164) Windows: don't use NULL DACL with system objects, namely the --service exit event and the netsh.exe guard semaphore. The old approach was prone to a local DoS where one user could interfere with other users' openvpn processes by blocking the netsh semaphore or sending events. This only affects setups not using the iservice, or using the automatic service to start/stop openvpn (CVE-2026-82312). (Bug found by DEBRAJ BASAK , tracked in Github: OpenVPN/openvpn-private-issues#167) Linux Netlink: validate netlink replies against the request (Suggested by Joshua Rogers as a security improvement, tracked in Github: OpenVPN/openvpn-private-issues#9) Windows: fix off-by-one on input validation in openvpnserv (discovered while fixing CVE-2026-78221) Windows: openvpnserv: pass correct NRPT domains size - when IDN domains with UTF8 encoding were involved, a buffer overread could be achieved (CVE-2026-78221). (Bug found by BreachX Zero Day Labs, using Typhon AI Mil v2, in Github: OpenVPN/openvpn-private-issues#162) Windows: harden CheckConfigPath() a bit more (another improvement while working on CVE-2026-78043) Windows: openvpnserv: don't allow '/' in config paths (the APIs windows uses for path validation do not handle '/' as path separator, while the file open APIs do, so this could be used to circumvent our config path validation, leading to openvpn.exe starting a user-controlled config file even if administatively not allowed. CVE-2026-78043) (Bug found by BreachX Zero Day Labs, using Typhon AI Mil v2, in Github: OpenVPN/openvpn-private-issues#162) Windows: dhcp: Fix off-by-one in write_dhcp_search_str() temp buffer guard (suitable DHCP options could lead to a single-byte overflow of a temp buffer, CVE-2026-81738) (Bug found by Andre Kropp (Nexory) and ChinhNguyen, tracked in Github: OpenVPN/openvpn-private-issues#165) Bugfixes work around a pubkey-handling bug in mbedTLS 4.1.0 and 4.2.0 (supposedly fixed in 4.3.0) multi: don't let stale-routes-check delete permanent routes (the --stale-routes-check did not delete dynamic cached routes, but also routes installed by --iroute and --ifconfig-push - fix by introducing route flags and restraining the check on them) (Github: #1063) Windows: openvpnserv: fix log lines format string interface names with international characters printed in some error messages need to be converted from UTF8 to UCS16 first. clinat: do not adjust UDP checksum if zero (as per RFC768) (Github: #1037) OpenSSL: avoid resetting the HMAC key on every packet (Github: #1088) fix format string specifier for size_t (%zu) ssl: Do not queue control ciphertext while a packet is still queued (fixes problems in TCP p2p handshake when both sides try to handshake at the same time) (Github: #1089) Reenable xmit_hold when using p2p tcp-server and tls-server (in TCP server mode, the server is not expected to initiate the TLS handshake - bug introduced by the multisocket code, checking the wrong variable for socket protocol) (Github: #1089) fix test_misc compile issues with -Werror User-visible Changes when using EPOCH data channel format, reduce number of future keys from 16 to 4 (calculation was wrong, 4 spare keys are sufficient for 100+ Gbit/s links, less log spam in userland and less resources used in in-kernel implementations) Building/Testing improvements clang-format: Convert deprecated setting KeepEmptyLinesAtTheStartOfBlocks t_client.sh: various improvements Documentation improvements doc: Update doxygen references to removed tunnel_server_{udp, tcp}() (those functions do not exist in 2.7+ anymore) Signed-off-by: Adolf Belka --- lfs/openvpn | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/openvpn b/lfs/openvpn index 010c3a375..266dc7140 100644 --- a/lfs/openvpn +++ b/lfs/openvpn @@ -24,7 +24,7 @@ include Config -VER = 2.7.6 +VER = 2.7.7 THISAPP = openvpn-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 0cf4f6c7337ef3e31cb6f261423863b86fedcaaa69272d26811f4066afcece873ccebca167cb5e9f37bc474ccbbad7f71effc0678b98ed52864a96351a8cc3f0 +$(DL_FILE)_BLAKE2 = 6f4230df1f238f0b0e1bdcc978850cf3f49c8c61dcebcdc819861399bf68016d14800140a2fb69bfc7fdc8fa4987cde531d59249f3f91533d7c9244080d557fc install : $(TARGET)