[ubuntu/resolute-security] openvpn 2.7.0-1ubuntu1.1 (Accepted)

[Marc Deslauriers]

openvpn (2.7.0-1ubuntu1.1) resolute-security; urgency=medium

  * SECURITY UPDATE: server ASSERT() via malformed packet
    - debian/patches/CVE-2026-35058.patch: avoid interpreting opcode as
      part of WKc in src/openvpn/tls_crypt.c,
      tests/unit_tests/openvpn/test_tls_crypt.c.
    - CVE-2026-35058
  * SECURITY UPDATE: race condition in TLS handshake
    - debian/patches/CVE-2026-40215.patch: ensure that buffer of freed
      session are not used in src/openvpn/ssl.c.
    - CVE-2026-40215

Date: 2026-04-23 14:23:10.646843+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/openvpn/2.7.0-1ubuntu1.1
-------------- next part --------------
Sorry, changesfile not available.