** Description changed:
This bug tracks an update for the OpenVPN package, moving to versions:
- * [Release codename] ([Release version]): OpenVPN [OpenVPN version - highest
possible number on the last digit]
- * [...]
+ * Resolute (26.04): OpenVPN 2.7.7
+ * Noble (24.04): OpenVPN 2.6.23
These updates include bug fixes following the SRU special case
documentation at
https://documentation.ubuntu.com/sru/en/latest/reference/exception-
OpenVPN-Updates
Note that openvpn does not have an accepted micro-release exception.
However, the SRU team has agreed to consider further releases given a
full knowledge and possible mitigation of backwards-incompatible
changes. See https://lists.ubuntu.com/archives/ubuntu-
release/2023-July/005688.html
- [Upstream changes]
+ [Upstream Changes]
- TODO: List updates, CVE fixes, and relevant bug fixes
- TODO: Add a link to the upstream changelog
+ 2.7.1-2.7.7
- TODO: Specifically note any backwards-incompatible changes or features
- added by upstream and their announcements/release notes and relevant
- commits.
+ Bug Fixes:
+
+ Fix usage of --lport inside a connection block.
+ Avoid breaking private-key passphrases of length >= 64.
+ Fix obscure ASSERT() crash on TCP connects with TAP and no IP config.
+ Make DCO work on Linux on big-endian systems.
+ Fix --management-query-passwords together with --auth-user-pass file.
+ Fix use-after-free of DNS options on client connect.
+ Fix memory leak in dns_server_addr_parse.
+ Improve multi-socket UDP event handling.
+ Fix port-share and multi-socket interaction.
+ Ensure a pushed tun-mtu is no lower than TUN_MTU_MIN.
+ Refuse incoming HARD RESET packets with a non-zero packet id.
+ Correctly calculate packet id size with the epoch data format.
+ Correct the minimum packet length check for 802.1Q tagged packets.
+ Make key state desync recoverable.
+ Make --x509-username-field work with mbedTLS.
+ Avoid letting --stale-routes-check delete permanent routes.
+ Do not adjust UDP checksum if zero.
+ Avoid resetting the HMAC key on every packet.
+ Do not queue control ciphertext while a packet is still queued.
+ Validate netlink replies against the request.
+
+ CVE Fixes - already available as patches in Ubuntu:
+
+ CVE-2026-35058: Server ASSERT() on a malformed packet with a valid
tls-crypt-v2 key.
+ CVE-2026-40215: Race condition in the TLS handshake that could leak packet
data from a previous handshake.
+ CVE-2026-11771: 1-byte buffer overrun on NTLMv2 proxy responses.
+ CVE-2026-12932: Memory leak in tls-crypt-v2 client key handling.
+ CVE-2026-12996: Use-after-free in ack_write_buf().
+ CVE-2026-13117: Use-after-free in tls_wrap_reneg().
+ CVE-2026-13122: Server crash on a malformed auth-token with --auth-gen-token
external-auth.
+ CVE-2026-13698: Memory leak from tls-crypt-v2 keys being set up twice.
+ CVE-2026-84471: Possible double-free in the lame duck case
(check_session_buf_not_used).
+ CVE-2026-84732: Unbounded reliable TLS timeout / acks for packets that cannot
be outstanding.
+
+
+ 2.6.20-2.6.23
+
+ Bug Fixes:
+
+ Stop periodic bytecount output when management client disconnects.
+ Make DCO work on big-endian architectures.
+ Fix DCO kernel notifications getting lost.
+ Fix use-after-free of DNS options on client connect.
+ Ensure a pushed tun-mtu is no lower than TUN_MTU_MIN.
+ Refuse incoming HARD RESET packets with a non-zero packet id.
+ Correct the minimum packet length check for 802.1Q tagged packets.
+ Make key state desync recoverable.
+ Do not trust the peer's request to resend the wrapped client key.
+
+ CVE Fixes match above - already available as patches in Ubuntu:
+
+ The upstream changelog is available at
https://community.openvpn.net/ReleaseHistory
+ Detailed release notes:
+ https://github.com/OpenVPN/openvpn/blob/release/2.7/Changes.rst
+ https://github.com/OpenVPN/openvpn/blob/release/2.6/Changes.rst
[Test Plan]
- TODO: Check DEP-8 and reverse-depends DEP-8 tests pass
- TODO: if there are any non passing tests - explain why that is ok in this case
- TODO: add results of an autopkgtest run against all the new versions
+ DEP-8 Tests:
+ server-setup-with-ca - creates and tests an OpenVPN server setup with its own
certificate authority
+ server-setup-with-static-key - creates and tests an OpenVPN server setup
using a static key for authentication
+
+ See https://documentation.ubuntu.com/sru/en/latest/reference/exception-
+ OpenVPN-Updates/#qa for additional testing information.
[Regression Potential]
Upstream has an extensive build and integration test suite. So
regressions would likely arise from a change in interaction with Ubuntu-
specific integrations.
- TODO: consider any other regression potential specific to the version being
- updated and list if any.
+ Backwards-incompatible changes:
+
+ Going through commits in 2.6.x, I found no backwards-incompatible
+ changes for noble.
+
+ As for 2.7.x, I found one change that could cause existing configs to be
denied:
+ In 2.7.4 no-op --enable-strict and --enable-strict-options configure flags
were removed.
+
+ [Other Info]
+
+ Previous backports:
+ (LP: #2127658)
+ (LP: #2073318)
+ (LP: #2040467)
+ (LP: #2004676)
** Changed in: openvpn (Ubuntu Jammy)
Status: In Progress => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2153488
Title:
Backport openvpn for stonking cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/2153488/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
