Skip to content
Snippets Groups Projects
Commit 70a31767 authored by Matthias Andree's avatar Matthias Andree
Browse files

security/openvpn: security update to 2.6.14

"Fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2

Security scope: OpenVPN servers between 2.6.1 and 2.6.13 using
--tls-crypt-v2 can be made to abort with an ASSERT() message by sending
a particular combination of authenticated and malformed packets.

To trigger the bug, a valid tls-crypt-v2 client key is needed, or
network observation of a handshake with a valid tls-crypt-v2 client key

No crypto integrity is violated, no data is leaked, and no remote code
execution is possible.

This bug does not affect OpenVPN clients."

ChangeLog:	https://github.com/OpenVPN/openvpn/blob/v2.6.14/Changes.rst#overview-of-changes-in-2614
Security:       2cad4541-0f5b-11f0-89f8-411aefea0df9
Security:       CVE-2025-2704
MFH:		2025Q2
parent a73af948
No related branches found
No related tags found
No related merge requests found
PORTNAME= openvpn
DISTVERSION= 2.6.13
DISTVERSION= 2.6.14
PORTREVISION?= 0
CATEGORIES= security net net-vpn
MASTER_SITES= https://swupdate.openvpn.org/community/releases/ \
......
TIMESTAMP = 1737076293
SHA256 (openvpn-2.6.13.tar.gz) = 1af10b86922bd7c99827cc0f151dfe9684337b8e5ebdb397539172841ac24a6a
SIZE (openvpn-2.6.13.tar.gz) = 1911719
TIMESTAMP = 1743554391
SHA256 (openvpn-2.6.14.tar.gz) = 9eb6a6618352f9e7b771a9d38ae1631b5edfeed6d40233e243e602ddf2195e7a
SIZE (openvpn-2.6.14.tar.gz) = 1926343
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment