openvpn (2.5.11-0ubuntu0.22.04.4) jammy-security; urgency=medium

  * SECURITY UPDATE: metadata buffer leak
    - debian/patches/CVE-2026-12932.patch: Clean up metadata handling in
      tls_crypt_v2_extract_client_key in src/openvpn/ssl.h,
      src/openvpn/ssl_common.h, src/openvpn/ssl.c, src/openvpn/tls_crypt.c,
      tests/unit_tests/openvpn/Makefile.am,
      tests/unit_tests/openvpn/test_tls_crypt.c.
    - CVE-2026-12932
  * SECURITY UPDATE: ack_write_buf use after free
    - debian/patches/CVE-2026-12996.patch: Fix ack_write_buf use after free in
      src/openvpn/ssl.c.
    - CVE-2026-12996
  * SECURITY UPDATE: DoS via memory leak with valid tls-crypt-v2 client key
    - debian/patches/CVE-2026-13698.patch: Ensure tls-crypt keys are not setup
      twice in src/openvpn/ssl.h, src/openvpn/tls_crypt.c.
    - CVE-2026-13698

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 08 Jul 2026 07:26:58 -0400

openvpn (2.5.11-0ubuntu0.22.04.3) jammy-security; urgency=medium

  * SECURITY UPDATE: server ASSERT() via malformed packet
    - debian/patches/CVE-2026-35058.patch: avoid interpreting opcode as
      part of WKc in src/openvpn/tls_crypt.c,
      tests/unit_tests/openvpn/test_tls_crypt.c.
    - CVE-2026-35058
  * SECURITY UPDATE: race condition in TLS handshake
    - debian/patches/CVE-2026-40215-pre1.patch: double check that we do not
      use a freed buffer when freeing a session in src/openvpn/ssl.c.
    - debian/patches/CVE-2026-40215-pre2.patch: do not check key_state
      buffers that are in S_UNDEF state in src/openvpn/ssl.c.
    - debian/patches/CVE-2026-40215-pre3.patch: fix
      check_session_buf_not_used using wrong index in src/openvpn/ssl.c.
    - debian/patches/CVE-2026-40215.patch: ensure that buffer of freed
      session are not used in src/openvpn/ssl.c.
    - CVE-2026-40215
  * Updated expired test certs
    - debian/patches/renew-test-certs.patch
    - debian/source/include-binaries: add sample/sample-keys/client.p12.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 23 Apr 2026 09:28:58 -0400

openvpn (2.5.11-0ubuntu0.22.04.1) jammy; urgency=medium

  * New upstream release 2.5.11 (LP: #2073318):
    - CVE Fixes:
      + CVE-2024-5594, CVE-2024-27459, CVE-2024-24974, CVE-2024-27903
    - Updates:
      + Allow trailing r and n in control channel message
      + See https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn25 for
        additional bug fixes and information
  * Remove patches fixed upstream:
    - d/p/CVE-2024-5594.patch
    [Fixed in 2.5.11]

 -- Lena Voytek <lena.voytek@canonical.com>  Tue, 17 Sep 2024 13:25:49 -0700

openvpn (2.5.9-0ubuntu0.22.04.3) jammy-security; urgency=medium

  * SECURITY UPDATE: malicious peer can DoS or send garbage to logs
    - debian/patches/CVE-2024-5594.patch: properly handle null bytes and
      invalid characters in control messages in src/openvpn/buffer.*,
      src/openvpn/forward.c, tests/unit_tests/openvpn/test_buffer.c.
    - CVE-2024-5594

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 27 Jun 2024 14:49:38 -0400

openvpn (2.5.9-0ubuntu0.22.04.2) jammy; urgency=medium

  * d/rules: Use --with-openssl-engine=yes during configuration to maintain the
    existing behavior of technically allowing openssl engine access in jammy.
    For more information see
    https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/2004676/comments/6

 -- Lena Voytek <lena.voytek@canonical.com>  Fri, 29 Sep 2023 16:14:48 -0700

openvpn (2.5.9-0ubuntu0.22.04.1) jammy; urgency=medium

  * New upstream release 2.5.9 (LP: #2004676):
    - The version is being updated to the latest in 2.5.x rather than 2.6.x to
      avoid feature releases and focus on bug fixes
    - Updates:
      + Allow optional ciphers in --data-ciphers
    - Bug Fixes Include:
      + Fix null pointer error when running openvpn --show-tls with mbedtls
      + Fix corner case that could lead to leaked file descriptor
      + Fix parsing issue in pull-filter when there are leading spaces
      + Fix possible buffer overflow in parse_line argument
      + See https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn25 for
        additional bug fixes and information

 -- Lena Voytek <lena.voytek@canonical.com>  Tue, 15 Aug 2023 10:48:49 -0700

openvpn (2.5.8-0ubuntu0.22.04.1) jammy; urgency=medium

  * New upstream releases 2.5.6-2.5.8 (LP: #2004676):
    - The version is being updated to the latest in 2.5.x rather than 2.6.x to
      avoid feature releases and focus on bug fixes
    - Updates:
      + OpenSSL3 support
      + pkcs11-helper upgrade to 1.28.4
      + allow running a default configuration with TLS libraries without BF-CBC
    - Bug Fixes Include:
      + CVE-2022-0547
      + Fix potential memory leaks in add_route() and add_route_ipv6()
      + Fix PATH_MAX build failure in auth-pam.c
      + Fix using --auth-token together with --management-client-auth
      + Fix clearing of username+password when using --auth-nocache
      + See https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn25 for
        additional bug fixes and information
  * Remove patches fixed upstream:
    - d/p/CVE-2022-0547.patch
      [Included in upstream release 2.5.6]
    - d/p/openssl-3/0001-Add-insecure-tls-cert-profile-options.patch
    - d/p/openssl-3/0002-Refactor-early-initialisation-and-uninitialisation-
      into-methods.patch
    - d/p/openssl-3/0003-Allow-loading-of-non-default-providers.patch
    - d/p/openssl-3/0004-Fix-allowing-showing-unsupported-ciphers-digests.patch
    - d/p/openssl-3/0005-Add-message-when-decoding-PKCS12-file-fails.patch
    - d/p/openssl-3/0006-Translate-OpenSSL-3.0-digest-names-to-OpenSSL-1.1-
      digest-names.patch
     [Included in upstream release 2.5.7]
    - d/p/openssl-3/0007-Allow-running-a-default-configuration-with-TLS-
      libraries-without-BF-CBC.patch
    - d/p/match-manpage-and-command-help.patch
      [Included in upstream release 2.5.8]

 -- Lena Voytek <lena.voytek@canonical.com>  Fri, 03 Feb 2023 15:49:35 -0700

openvpn (2.5.5-1ubuntu3.1) jammy; urgency=medium

  * d/p/openssl-3/*.patch: backport upstream patch set to better support
    OpenSSL 3 (LP: #1975574)

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Thu, 14 Jul 2022 11:21:14 -0300

openvpn (2.5.5-1ubuntu3) jammy; urgency=medium

  * debian/patches/CVE-2022-0547.patch: updated to properly patch actual
    manpage file in doc/openvpn.8.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 22 Mar 2022 13:22:27 -0400

openvpn (2.5.5-1ubuntu2) jammy; urgency=medium

  * SECURITY UPDATE: authentication bypass via multiple deferred
    authentication plug-ins
    - debian/patches/CVE-2022-0547.patch: disallow multiple deferred
      authentication plug-ins in doc/man-sections/plugin-options.rst,
      src/openvpn/plugin.c.
    - CVE-2022-0547

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 22 Mar 2022 10:37:55 -0400

# For older changelog entries, run 'apt-get changelog openvpn'
