[ubuntu/jammy-security] openvpn 2.5.11-0ubuntu0.22.04.3 (Accepted)

[Marc Deslauriers]

openvpn (2.5.11-0ubuntu0.22.04.3) jammy-security; urgency=medium

  * SECURITY UPDATE: server ASSERT() via malformed packet
    - debian/patches/CVE-2026-35058.patch: avoid interpreting opcode as
      part of WKc in src/openvpn/tls_crypt.c,
      tests/unit_tests/openvpn/test_tls_crypt.c.
    - CVE-2026-35058
  * SECURITY UPDATE: race condition in TLS handshake
    - debian/patches/CVE-2026-40215-pre1.patch: double check that we do not
      use a freed buffer when freeing a session in src/openvpn/ssl.c.
    - debian/patches/CVE-2026-40215-pre2.patch: do not check key_state
      buffers that are in S_UNDEF state in src/openvpn/ssl.c.
    - debian/patches/CVE-2026-40215-pre3.patch: fix
      check_session_buf_not_used using wrong index in src/openvpn/ssl.c.
    - debian/patches/CVE-2026-40215.patch: ensure that buffer of freed
      session are not used in src/openvpn/ssl.c.
    - CVE-2026-40215
  * Updated expired test certs
    - debian/patches/renew-test-certs.patch
    - debian/source/include-binaries: add sample/sample-keys/client.p12.

openvpn (2.5.11-0ubuntu0.22.04.1) jammy; urgency=medium

  * New upstream release 2.5.11 (LP: #2073318):
    - CVE Fixes:
      + CVE-2024-5594, CVE-2024-27459, CVE-2024-24974, CVE-2024-27903
    - Updates:
      + Allow trailing \r and \n in control channel message
      + See https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn25 for
        additional bug fixes and information
  * Remove patches fixed upstream:
    - d/p/CVE-2024-5594.patch
    [Fixed in 2.5.11]

Date: 2026-04-23 19:03:11.048465+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/openvpn/2.5.11-0ubuntu0.22.04.3
-------------- next part --------------
Sorry, changesfile not available.