openvpn (2.6.12-0ubuntu0.24.04.3~bpo22.04.1) jammy-backports; urgency=medium

  * Backport to Jammy (LP: #2097688):
    - Fixes openvpn issues on FIPS enabled jammy systems
    - Fixed dependencies because systemctl-dev does not exist in jammy. Using
      systemd instead as the original jammy package.

 -- Jorge Merlino <jorge.merlino@canonical.com>  Wed, 30 Apr 2025 14:41:24 -0300

openvpn (2.6.12-0ubuntu0.24.04.3) noble-security; urgency=medium

  * SECURITY UPDATE: denial of service issue
    - debian/patches/CVE-2025-2704.patch: allow tls-crypt-v2 to be setup
      only on initial packet of a session in src/openvpn/ssl.c,
      src/openvpn/ssl_common.h, src/openvpn/ssl_pkt.c,
      src/openvpn/ssl_pkt.h, src/openvpn/tls_crypt.c,
      src/openvpn/tls_crypt.h, tests/unit_tests/openvpn/test_tls_crypt.c.
    - CVE-2025-2704

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 01 Apr 2025 12:06:17 -0400

openvpn (2.6.12-0ubuntu0.24.04.1) noble; urgency=medium

  * New upstream release 2.6.12 (LP: #2073318):
    - CVE Fixes:
      + CVE-2024-4877, CVE-2024-5594, CVE-2024-28882, CVE-2024-27459,
        CVE-2024-24974, CVE-2024-27903
    - Updates:
      + Allow trailing r and n in control channel message
      + Implement --server-poll-timeout on SOCKS proxies
      + Implement Windows CA template match for Crypto-API selector
      + Update sample configuration files
      + Update systemd unit file documentation references
    - Bug Fixes Include:
      + Fix issue with proxy credentials caching
      + Fix LibreSSL crashing when enumerating digests/cipher with workaround
      + Use snprintf instead of sprintf for get_ssl_library_version
      + Fix disabling DCO when proxy is set via management interface
      + See https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn26 for
        additional bug fixes and information
  * Remove patches fixed upstream:
    - d/p/systemd.patch
    [Fixed in 2.6.10]
    - d/p/CVE-2024-28882.patch
    - d/p/CVE-2024-5594.patch
    [Fixed in 2.6.11]

 -- Lena Voytek <lena.voytek@canonical.com>  Tue, 17 Sep 2024 10:27:52 -0700

openvpn (2.6.9-1ubuntu4.1) noble-security; urgency=medium

  * SECURITY UPDATE: client can circumvent management client-kill
    - debian/patches/CVE-2024-28882.patch: only schedule_exit() once in
      src/openvpn/forward.*, src/openvpn/push.c.
    - CVE-2024-28882
  * SECURITY UPDATE: malicious peer can DoS or send garbage to logs
    - debian/patches/CVE-2024-5594.patch: properly handle null bytes and
      invalid characters in control messages in src/openvpn/buffer.*,
      src/openvpn/forward.c, tests/unit_tests/openvpn/test_buffer.c.
    - CVE-2024-5594

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 27 Jun 2024 14:21:42 -0400

openvpn (2.6.9-1ubuntu4) noble; urgency=high

  * No change rebuild against libssl3t64.

 -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 08 Apr 2024 16:47:03 +0200

openvpn (2.6.9-1ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 09:23:46 +0000

openvpn (2.6.9-1ubuntu2) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Mar 2024 20:31:57 +0000

openvpn (2.6.9-1ubuntu1) noble; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Thu, 29 Feb 2024 17:22:31 +0100

openvpn (2.6.9-1) unstable; urgency=medium

  * New upstream version 2.6.9
  * Switch to systemd-dev (Closes: #1060500)
  * Install systemd generator and units into /usr. (Closes: #1064399)

 -- Bernhard Schmidt <berni@debian.org>  Wed, 28 Feb 2024 08:43:25 +0100

openvpn (2.6.7-1ubuntu1) noble; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Mon, 13 Nov 2023 18:36:03 +0100

# For older changelog entries, run 'apt-get changelog openvpn'
