linux/meta-openembedded.git/meta-networking/recipes-support/openvpn, branch scarthgap

openvpn: ignore CVE-2025-13751

2026-01-26T04:34:48+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2025-13751 The vulnerability is Windows specific, can be ignored. Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

openvpn: patch CVE-2025-13086

2025-12-17T06:15:24+00:00

Details https://nvd.nist.gov/vuln/detail/CVE-2025-13086 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

openvpn: upgrade 2.6.12 -> 2.6.14

2025-04-17T00:33:50+00:00

This includes CVE-fix for CVE-2025-2704 Changelog: ========== https://github.com/OpenVPN/openvpn/releases For full details, refer to: https://github.com/OpenVPN/openvpn/compare/v2.6.12...v2.6.14 Signed-off-by: Divya Chellam Signed-off-by: Armin Kuster

openvpn: upgrade 2.6.10 -> 2.6.12

2024-11-24T22:37:58+00:00

ChangeLog: https://github.com/OpenVPN/openvpn/blob/v2.6.12/Changes.rst Security fixes: CVE-2024-4877: Windows: harden interactive service pipe. Security scope: a malicious process with "some" elevated privileges (SeImpersonatePrivilege) could open the pipe a second time, tricking openvn GUI into providing user credentials (tokens), getting full access to the account openvpn-gui.exe runs as. CVE-2024-5594: control channel: refuse control channel messages with nonprintable characters in them. Security scope: a malicious openvpn peer can send garbage to openvpn log, or cause high CPU load. CVE-2024-28882: only call schedule_exit() once (on a given peer). Security scope: an authenticated client can make the server "keep the session" even when the server has been told to disconnect this client. Signed-off-by: Haixiao Yan [Drop CVE-2024-28882 patch not yet in stable] Signed-off-by: Armin Kuster

openvpn: fix CVE-2024-28882

2024-11-09T19:51:28+00:00

CVE-2024-28882: OpenVPN in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session References: https://community.openvpn.net/openvpn/wiki/CVE-2024-28882 Signed-off-by: Haixiao Yan Signed-off-by: Armin Kuster

openvpn: upgrade 2.6.9 -> 2.6.10

2024-03-21T15:46:06+00:00

License-Update: Update copyright years to 2024 ChangeLog: https://github.com/OpenVPN/openvpn/blob/v2.6.10/Changes.rst Security fixes: CVE-2024-27459: Windows: fix a possible stack overflow in the interactive service component which might lead to a local privilege escalation. CVE-2024-24974: Windows: disallow access to the interactive service pipe from remote computers. CVE-2024-27903: Windows: disallow loading of plugins from untrusted installation paths, which could be used to attack openvpn.exe via a malicious plugin. Plugins can now only be loaded from the OpenVPN install directory, the Windows system directory, and possibly from a directory specified by HKLM\SOFTWARE\OpenVPN\plugin_dir. CVE-2024-1305: Windows TAP driver: Fix potential integer overflow in !TapSharedSendPacket. Signed-off-by: Yi Zhao Signed-off-by: Khem Raj

openvpn: upgrade 2.6.7 -> 2.6.9

2024-03-03T03:48:04+00:00

License-Update: Remove conditional text for Apache2 linking exception[1] ChangeLog: https://github.com/OpenVPN/openvpn/blob/v2.6.9/Changes.rst [1] https://github.com/OpenVPN/openvpn/commit/20bc8bd5af9d1ee0489d0ee58ae9c2c2f9b0cf9f Signed-off-by: Yi Zhao Signed-off-by: Khem Raj

openvpn: upgrade 2.6.6 -> 2.6.7

2023-11-17T19:38:20+00:00

Changelog: ============ dco: fix crash when --multihome is used with --proto tcp Mock openvpn_exece on win32 also for test_tls_crypt Add warning for the --show-groups command that some groups are missing Print peer temporary key details Add warning if a p2p NCP client connects to a p2mp server Remove openssl engine method for loading the key Remove saving initial frame code Double check that we do not use a freed buffer when freeing a session Fix using to_link buffer after freed GHA: do not trigger builds in openvpn-build anymore GHA: new workflow to submit scan to Coverity Scan service buffer: use memcpy in buf_catrunc vcpkg-ports/pkcs11-helper: Backport MinGW series from master to release/2.6 CMake: backport CMake buildsystem from master to release/2.6 Remove all traces of the previous MSVC build system doc: fix argument name in --route-delay documentation dns option: remove support for exclude-domains Warn user if INFO control command is too long dco-win: get driver version dco: warn if DATA_V1 packets are sent to userspace Make cert_data.h and test_cryptoapi/pkcs11.c MSVC compliant Log OpenSSL errors on failure to set certificate configure: disable engines if OPENSSL_NO_ENGINE is defined Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

openvpn: upgrade 2.6.3 -> 2.6.6

2023-11-06T16:48:27+00:00

License-Update: Added Apache2 linking exception Signed-off-by: Khem Raj

cve_check: convert CVE_CHECK_IGNORE to CVE_STATUS

2023-07-27T15:54:40+00:00

- Try to add convert and apply statuses for old CVEs - Drop some obsolete ignores, while they are not relevant for current version Signed-off-by: Andrej Valek Signed-off-by: Khem Raj