openvpn (2.6.19-0ubuntu0.24.04.3) noble-security; urgency=medium

  * SECURITY UPDATE: buffer overrun via NTLMv2 proxy responses
    - debian/patches/CVE-2026-11771.patch: Fix 1-byte buffer overrun on NTLMv2
      proxy responses. in src/openvpn/ntlm.c.
    - CVE-2026-11771
  * SECURITY UPDATE: metadata buffer leak
    - debian/patches/CVE-2026-12932-pre1.patch: Zeroize tls-crypt-v2 client
      keys in src/openvpn/ssl_pkt.c, src/openvpn/tls_crypt.c.
    - debian/patches/CVE-2026-12932.patch: Clean up metadata handling in
      tls_crypt_v2_extract_client_key in src/openvpn/ssl.h,
      src/openvpn/ssl_common.h, src/openvpn/ssl_pkt.c, src/openvpn/tls_crypt.c,
      tests/unit_tests/openvpn/test_tls_crypt.c.
    - CVE-2026-12932
  * SECURITY UPDATE: ack_write_buf use after free
    - debian/patches/CVE-2026-12996.patch: Fix ack_write_buf use after free in
      src/openvpn/ssl.c.
    - CVE-2026-12996
  * SECURITY UPDATE: tls_wrap_reneg use after free
    - debian/patches/CVE-2026-13117.patch: Fix tls_wrap_reneg use after free in
      src/openvpn/ssl.c.
    - CVE-2026-13117
  * SECURITY UPDATE: DoS via malformed authentication token
    - debian/patches/CVE-2026-13122.patch: Ensure we only get the session from
      valid tokens for external-auth in doc/man-sections/server-options.rst,
      src/openvpn/auth_token.c, src/openvpn/auth_token.h,
      src/openvpn/ssl_verify.c, tests/unit_tests/openvpn/test_auth_token.c.
    - CVE-2026-13122
  * SECURITY UPDATE: DoS via memory leak with valid tls-crypt-v2 client key
    - debian/patches/CVE-2026-13698.patch: Ensure tls-crypt keys are not setup
      twice in src/openvpn/ssl.c, src/openvpn/ssl.h, src/openvpn/ssl_pkt.c,
      src/openvpn/ssl_pkt.h, src/openvpn/tls_crypt.c, src/openvpn/tls_crypt.h,
      tests/unit_tests/openvpn/test_tls_crypt.c.
    - CVE-2026-13698

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 07 Jul 2026 19:00:45 -0400

openvpn (2.6.19-0ubuntu0.24.04.2) noble-security; urgency=medium

  * SECURITY UPDATE: server ASSERT() via malformed packet
    - debian/patches/CVE-2026-35058.patch: avoid interpreting opcode as
      part of WKc in src/openvpn/tls_crypt.c,
      tests/unit_tests/openvpn/test_tls_crypt.c.
    - CVE-2026-35058
  * SECURITY UPDATE: race condition in TLS handshake
    - debian/patches/CVE-2026-40215.patch: ensure that buffer of freed
      session are not used in src/openvpn/ssl.c.
    - CVE-2026-40215

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 23 Apr 2026 09:09:25 -0400

openvpn (2.6.19-0ubuntu0.24.04.1) noble; urgency=medium

  * New upstream version 2.6.19 (LP: #2127658):
    - CVE Fixes:
      + CVE-2025-13086
    - Updates:
      + Disable DCO if --bind-dev option is given
    - Bug Fixes:
      + Fix incorrect file descriptor handling in p2mp server on inotify FD
        during a SIGUSR1 restart.
      + Fix bug where --management-forget-disconnect and --management-signal
        could be executed even if password authentication to managment
        interface was still pending.
      + Repair client-side interaction on reconnect between DCO event handling
        and --persist-tun.
      + Prevent crash on invalid server-ipv6 argument.
      + Fix invalid pointer creation in tls_pre_decrypt().
      + Properly check for errors in creation on $auth_failed_reason_file.
      + Apply close-on-exec option to correct socket for incoming TCP
        connections.
      + Fix missing perf_pop() call in ssl_mbedtls.
      + Apply more checks to incoming TLS handshake packets before creating new
        state.
      + Fix broadcast address configuration for broadcast-based applications
        using ifconfig to get address.
    - See https://community.openvpn.net/ReleaseHistory for additional
      information.
  * Remove patches fixed upstream:
    - d/p/CVE-2025-13086.patch
    [Fixed in 2.6.16]
    - d/p/handle_intentional_route_push_float_ip.patch
    [Fixed in 2.6.15]
  * d/watch: Update download URL.

 -- Lena Voytek <lena.voytek@canonical.com>  Fri, 20 Feb 2026 18:13:25 -0500

openvpn (2.6.14-0ubuntu0.24.04.3) noble-security; urgency=medium

  * SECURITY UPDATE: incorrect HMAC verification check
    - debian/patches/CVE-2025-13086.patch: fix memcmp check for the hmac
      verification in the 3way handshake being inverted in
      src/openvpn/ssl_pkt.c, tests/unit_tests/openvpn/test_pkt.c.
    - CVE-2025-13086

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 24 Nov 2025 17:32:32 -0500

openvpn (2.6.14-0ubuntu0.24.04.2) noble; urgency=medium

  * d/p/handle_intentional_route_push_float_ip.patch: Fix floating IP due
    to "route VPN_IP net_gateway", which can lead to incorrect blocking of
    a source IP switch for 60 seconds immediately after connection setup.
    (LP: #2108860)

 -- Jonas Jelten <jonas.jelten@canonical.com>  Tue, 09 Sep 2025 16:36:28 +0200

openvpn (2.6.14-0ubuntu0.24.04.1) noble; urgency=medium

  * New upstream version 2.6.14 (LP: #2040467):
    - CVE Fixes:
      + CVE-2025-2704
    - Updates:
      + Send uname() release from client to server as IV_PLAT_VER.
      + Pass --timeout=0 argument to systemd-ask-password, to avoid default
        timeout of 90 seconds.
    - Bug Fixes:
      + Repair source IP selection for --multihome.
      + Allow tls-crypt-v2 to be setup only on initial packet of a session.
      + Fix some missing spaces in messages.
      + Fix parsing of usernames or passwords longer than USER_PASS_LEN on the
        server side to avoid IV variable misparsing and misleading errors.
      + Purge proxy authentication credentials from memory after use (if
        --auth-nocache is in use).
    - See https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn26 for
      additional bug fixes and information.
  * Remove patches fixed upstream:
    - d/p/CVE-2025-2704.patch
    [Fixed in 2.6.14]
  * d/t/control: Move to isolation-container to enable armhf/LXD coverage (LP 2104146).

 -- Lena Voytek <lena.voytek@canonical.com>  Fri, 30 May 2025 11:24:52 -0400

openvpn (2.6.12-0ubuntu0.24.04.3) noble-security; urgency=medium

  * SECURITY UPDATE: denial of service issue
    - debian/patches/CVE-2025-2704.patch: allow tls-crypt-v2 to be setup
      only on initial packet of a session in src/openvpn/ssl.c,
      src/openvpn/ssl_common.h, src/openvpn/ssl_pkt.c,
      src/openvpn/ssl_pkt.h, src/openvpn/tls_crypt.c,
      src/openvpn/tls_crypt.h, tests/unit_tests/openvpn/test_tls_crypt.c.
    - CVE-2025-2704

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 01 Apr 2025 12:06:17 -0400

openvpn (2.6.12-0ubuntu0.24.04.1) noble; urgency=medium

  * New upstream release 2.6.12 (LP: #2073318):
    - CVE Fixes:
      + CVE-2024-4877, CVE-2024-5594, CVE-2024-28882, CVE-2024-27459,
        CVE-2024-24974, CVE-2024-27903
    - Updates:
      + Allow trailing \r and \n in control channel message
      + Implement --server-poll-timeout on SOCKS proxies
      + Implement Windows CA template match for Crypto-API selector
      + Update sample configuration files
      + Update systemd unit file documentation references
    - Bug Fixes Include:
      + Fix issue with proxy credentials caching
      + Fix LibreSSL crashing when enumerating digests/cipher with workaround
      + Use snprintf instead of sprintf for get_ssl_library_version
      + Fix disabling DCO when proxy is set via management interface
      + See https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn26 for
        additional bug fixes and information
  * Remove patches fixed upstream:
    - d/p/systemd.patch
    [Fixed in 2.6.10]
    - d/p/CVE-2024-28882.patch
    - d/p/CVE-2024-5594.patch
    [Fixed in 2.6.11]

 -- Lena Voytek <lena.voytek@canonical.com>  Tue, 17 Sep 2024 10:27:52 -0700

openvpn (2.6.9-1ubuntu4.1) noble-security; urgency=medium

  * SECURITY UPDATE: client can circumvent management client-kill
    - debian/patches/CVE-2024-28882.patch: only schedule_exit() once in
      src/openvpn/forward.*, src/openvpn/push.c.
    - CVE-2024-28882
  * SECURITY UPDATE: malicious peer can DoS or send garbage to logs
    - debian/patches/CVE-2024-5594.patch: properly handle null bytes and
      invalid characters in control messages in src/openvpn/buffer.*,
      src/openvpn/forward.c, tests/unit_tests/openvpn/test_buffer.c.
    - CVE-2024-5594

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 27 Jun 2024 14:21:42 -0400

openvpn (2.6.9-1ubuntu4) noble; urgency=high

  * No change rebuild against libssl3t64.

 -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 08 Apr 2024 16:47:03 +0200

openvpn (2.6.9-1ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 09:23:46 +0000

openvpn (2.6.9-1ubuntu2) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Mar 2024 20:31:57 +0000

openvpn (2.6.9-1ubuntu1) noble; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Thu, 29 Feb 2024 17:22:31 +0100

openvpn (2.6.9-1) unstable; urgency=medium

  * New upstream version 2.6.9
  * Switch to systemd-dev (Closes: #1060500)
  * Install systemd generator and units into /usr. (Closes: #1064399)

 -- Bernhard Schmidt <berni@debian.org>  Wed, 28 Feb 2024 08:43:25 +0100

openvpn (2.6.7-1ubuntu1) noble; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Mon, 13 Nov 2023 18:36:03 +0100

openvpn (2.6.7-1) unstable; urgency=medium

  [ Aquila Macedo ]
  * d/control: bump debhelper-compat level to 13.
  * d/patches: Remove outdated patches
  * d/patches: fix typo in openvpn binary
  * d/patches: fix typo in manpages
  * d/copyright: Update license to BSD-2
  * d/openvpn.service: add documentation

  [ Bernhard Schmidt ]
  * New upstream version 2.6.7, fixing two CVEs (Closes: #1055805)
    - CVE-2023-46849: Use of --fragment option can lead to a division by zero
      error which can be fatal
    - CVE-2023-46850: Incorrect use of send buffer can cause memory to be sent
      to peer
  * Pick patch recommended by upstream in GH#449 to fix segfault
    introduced in 2.6.7

  [ Remus-Gabriel Chelu ]
  * Add Romanian templates translation (Closes: #1033179)

 -- Bernhard Schmidt <berni@debian.org>  Sat, 11 Nov 2023 22:01:15 +0100

openvpn (2.6.5-0ubuntu1) mantic; urgency=medium

  * New Upstream release 2.6.5 (LP: #2018095)
  * d/p/fix-dangling-pointer-in-pkcs11.patch:
    Remove - fixed upstream in 2.6.4
  * d/p/fix-memleak-in-dco_get_peer_stats_multi.patch:
    Remove - fixed upstream in 2.6.5

 -- Lena Voytek <lena.voytek@canonical.com>  Tue, 11 Jul 2023 09:36:08 -0700

openvpn (2.6.3-2.1) unstable; urgency=medium

  * Non-maintainer upload.

  [ Helmut Grohne ]
  * Do not install systemd units twice (Closes: #1054083)

 -- Jochen Sprickerhof <jspricke@debian.org>  Fri, 27 Oct 2023 16:26:34 +0200

openvpn (2.6.3-2ubuntu1) mantic; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Mon, 22 May 2023 09:28:33 +0200

openvpn (2.6.3-2) unstable; urgency=medium

  * Cherry-pick two bugfix commits from upstream
    - Memory leak in dco_get_peer_stats_multi for Linux
    - dangling pointer passed to pkcs11-helper

 -- Bernhard Schmidt <berni@debian.org>  Sat, 20 May 2023 17:43:32 +0200

openvpn (2.6.3-1ubuntu1) mantic; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Tue, 02 May 2023 08:48:22 +0200

openvpn (2.6.3-1) unstable; urgency=medium

  * New upstream version 2.6.2
    - drop patches applied upstream
    - needs new openvpn-dco-dkms version. Not adding a versioned dependency
      to untangle testing migration, because it will just not use the
      "wrong" version and run unaccelerated.
  * New upstream version 2.6.3

 -- Bernhard Schmidt <berni@debian.org>  Thu, 13 Apr 2023 09:19:40 +0200

openvpn (2.6.1-1ubuntu1) lunar; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Mon, 27 Mar 2023 07:50:09 +0200

openvpn (2.6.1-1) unstable; urgency=medium

  * Upload to unstable targetting bookworm
  * Cherry-Pick upstream commits from 2.6.2
    - fix rare ASSERT in tls-crypt
    - fix memory leaks in HMAC initial packet generation
    - set netlink socket to be non-blocking

 -- Bernhard Schmidt <berni@debian.org>  Sun, 26 Mar 2023 11:14:26 +0200

openvpn (2.6.1-1~exp1) experimental; urgency=medium

  * New upstream version 2.6.1
    - target experimental due to the freeze

 -- Bernhard Schmidt <berni@debian.org>  Fri, 10 Mar 2023 09:02:22 +0100

openvpn (2.6.0-1ubuntu1) lunar; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Thu, 26 Jan 2023 22:11:25 +0100

openvpn (2.6.0-1) unstable; urgency=medium

  * New upstream version 2.6.0
  * Drop dco netlink buffer overflow patch applied upstream
  * Drop obsolete lsb-base dependency

 -- Bernhard Schmidt <berni@debian.org>  Wed, 25 Jan 2023 22:27:04 +0100

openvpn (2.6.0~rc2-1ubuntu1) lunar; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Mon, 16 Jan 2023 09:28:16 +0100

openvpn (2.6.0~rc2-1) unstable; urgency=medium

  * New upstream version 2.6.0~rc2
  * Add upstream pending patch to work around dco netlink buffer overflow

 -- Bernhard Schmidt <berni@debian.org>  Fri, 13 Jan 2023 19:02:01 +0100

openvpn (2.6.0~rc1-1ubuntu1) lunar; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Thu, 29 Dec 2022 14:05:47 +0100

openvpn (2.6.0~rc1-1) unstable; urgency=medium

  * New upstream version 2.6.0~rc1 (Closes: #1014376)
  * Drop DCO workaround applied upstream

 -- Bernhard Schmidt <berni@debian.org>  Wed, 28 Dec 2022 22:51:31 +0100

openvpn (2.6.0~git20221222-1ubuntu1) lunar; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Sat, 24 Dec 2022 15:56:10 +0100

openvpn (2.6.0~git20221222-1) unstable; urgency=medium

  * New upstream version 2.6.0~git20221222
  * Import pending upstream fix for race conditions in DCO servers
  * d/openvpn@.service: Replace LimitNPROC=100 with TasksMax=10
    (see Bug#861923 for discussion)

 -- Bernhard Schmidt <berni@debian.org>  Fri, 23 Dec 2022 22:43:39 +0100

openvpn (2.6.0~git20221215+beta2-1) unstable; urgency=medium

  * New upstream version 2.6.0~git20221215+beta2

 -- Bernhard Schmidt <berni@debian.org>  Fri, 16 Dec 2022 11:54:27 +0100

openvpn (2.6.0~git20221201-1ubuntu1) lunar; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Tue, 06 Dec 2022 15:47:55 +0100

openvpn (2.6.0~git20221201-1) unstable; urgency=medium

  * New upstream version 2.6.0~git20221201, also known as 2.6_beta1
  * Update d/NEWS to list known backwards compatibility issues
  * Fix national encoding on d/po/{es,sv}.po
  * Drop obsolete patches

 -- Bernhard Schmidt <berni@debian.org>  Sun, 04 Dec 2022 21:32:37 +0100

openvpn (2.6.0~git20221116-1ubuntu1) lunar; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Wed, 23 Nov 2022 14:50:31 +0100

openvpn (2.6.0~git20221116-1) unstable; urgency=medium

  * New upstream version 2.6.0~git20221116
    * Various improvements regarding MTU calculation

 -- Bernhard Schmidt <berni@debian.org>  Tue, 22 Nov 2022 11:50:13 +0100

openvpn (2.6.0~git20220818-1ubuntu1) kinetic; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Mon, 22 Aug 2022 09:44:45 +0200

openvpn (2.6.0~git20220818-1) unstable; urgency=medium

  * New upstream version 2.6.0~git20220818
  * Only depend on libcap-ng-dev on Linux
  * Drop d/p/disable-dco-without-necessary-capabilities applied upstream

 -- Bernhard Schmidt <berni@debian.org>  Thu, 18 Aug 2022 10:48:47 +0200

openvpn (2.6.0~git20220811-2) unstable; urgency=medium

  * Cherry-Pick proposed upstream fix to disable DCO if unable to retain
    capabilities, fixes network-manager-openvpn together with DCO
    (Closes: #1017379)

 -- Bernhard Schmidt <berni@debian.org>  Wed, 17 Aug 2022 15:30:31 +0200

openvpn (2.6.0~git20220811-1) unstable; urgency=medium

  * New upstream version 2.6.0~git20220811
    * Retain CAP_NET_ADMIN when dropping privileges (Closes: #976070)
  * Add build-dependency on libcap-ng-dev
  * Explicitly disable unit tests (Closes: #1016057)
  * Drop obsolete entries from d/copyright

 -- Bernhard Schmidt <berni@debian.org>  Thu, 11 Aug 2022 16:05:36 +0200

openvpn (2.6.0~git20220808-1) unstable; urgency=medium

  [ Gianfranco Costamagna ]
  * d/t/server-setup-with-ca:
    - cherry-pick change in easy-rsa autopkgtests to remove conflicting
      "vars" file.

  [ Bernhard Schmidt ]
  * New upstream version 2.6.0~git20220808
    - switch to master branch now that DCO support has been merged
  * Drop OpenSSL 3.0 digest name patch applied upstream

 -- Bernhard Schmidt <berni@debian.org>  Tue, 09 Aug 2022 11:31:12 +0200

openvpn (2.6.0~git20220518+dco-3ubuntu2) kinetic; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)
    - d/t/server-setup-with-ca:
      - cherry-pick change in easy-rsa autopkgtests to remove conflicting
        "vars" file.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Thu, 28 Jul 2022 08:58:35 +0200

openvpn (2.6.0~git20220518+dco-3) unstable; urgency=medium

  [ Lucas Kanashiro ]
  * d/t/server-setup-with-static-key: set cipher to be DES-EDE3-CBC
  * d/t/server-setup-with-static-key: use 'secret' to generate key
  * d/t/server-setup-with-*: use 'set -x' in the test scripts
  * d/t/control: add allow-stderr restriction

  [ Bernhard Schmidt ]
  * Import Ubuntu patch cherry-picked from upstream to translate OpenSSL 3.0
    digest names into OpenSSL 1.1 digest names (Closes: #1012129)

 -- Bernhard Schmidt <berni@debian.org>  Sun, 24 Jul 2022 17:13:47 +0200

openvpn (2.6.0~git20220518+dco-2ubuntu3) kinetic; urgency=medium

  * d/t/control: add allow-stderr restriction. With 'set -x' in place some
    messages are printed out in stderr.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Thu, 14 Jul 2022 11:47:23 -0300

openvpn (2.6.0~git20220518+dco-2ubuntu2) kinetic; urgency=medium

  * d/t/server-setup-with-static-key: set cipher to be DES-EDE3-CBC. The
    default BF-CBC is deprecated, also CAST and RC2. For more information
    check the upstream documentation.
  * d/t/server-setup-with-static-key: use 'secret' instead of '--secret' when
    generating a key to fix a deprecation warning.
  * d/t/server-setup-with-*: use 'set -x' in the test scripts. This will
    facilitate future debugging.
  * d/p/openssl-3-support.patch: Translate OpenSSL 3.0 digest names to OpenSSL
    1.1 digest names (LP: #1975574).

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Mon, 11 Jul 2022 17:56:18 -0300

openvpn (2.6.0~git20220518+dco-2ubuntu1) kinetic; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)
  * Drop changes fixed in new upstream release:
    - d/p/openvpn-fips-2.4.patch: Allow MD5 for PRF in FIPS mode openssl.
    - d/p/OpenSSL3.patch: work around the deprecated algorithm mismatch between
      the OpenSSL3 branch and the OpenVPN 2.5 branch (LP #1945980)
    - debian/patches/CVE-2022-0547.patch: disallow multiple deferred
      authentication plug-ins in doc/man-sections/plugin-options.rst,
      src/openvpn/plugin.c.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Tue, 07 Jun 2022 11:51:28 +0200

openvpn (2.6.0~git20220518+dco-2) unstable; urgency=medium

  * Add d/NEWS entry about the release notes and DCO (Closes: #1011372)

 -- Bernhard Schmidt <berni@debian.org>  Mon, 30 May 2022 15:44:41 +0200

openvpn (2.6.0~git20220518+dco-1) unstable; urgency=medium

  * New upstream version 2.6.0~git20220518+dco
  * Release to unstable
  * Revert "Build against OpenSSL 3.0", OpenSSL 3.0 has landed in unstable

 -- Bernhard Schmidt <berni@debian.org>  Fri, 20 May 2022 08:35:29 +0200

openvpn (2.6.0~git20220510+dco-1) experimental; urgency=medium

  * New upstream version 2.6.0~git20220510+dco
  * Suggest openvpn-dco-dkms
  * Drop iproute2, linux builds use netlink
  * Limit libnl-genl-3-dev build-dep (for dco) to linux-any
  * Build against OpenSSL 3.0

 -- Bernhard Schmidt <berni@debian.org>  Fri, 13 May 2022 00:01:35 +0200

openvpn (2.6.0~git20220317+dco-1) experimental; urgency=medium

  * New upstream version 2.6.0~git20220317+dco
    This is a snapshot of the upstream dco branch (data-channel offloading)

 -- Bernhard Schmidt <berni@debian.org>  Mon, 21 Mar 2022 11:54:29 +0100

openvpn (2.5.6-1) unstable; urgency=high

  * New upstream version 2.5.6
    CVE-2022-0547 - Potential authentication by-pass with multiple deferred
    authentication plug-ins plug-ins (Closes: #1008015)

 -- Bernhard Schmidt <berni@debian.org>  Sun, 20 Mar 2022 21:42:05 +0100

openvpn (2.5.5-1ubuntu3) jammy; urgency=medium

  * debian/patches/CVE-2022-0547.patch: updated to properly patch actual
    manpage file in doc/openvpn.8.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 22 Mar 2022 13:22:27 -0400

openvpn (2.5.5-1ubuntu2) jammy; urgency=medium

  * SECURITY UPDATE: authentication bypass via multiple deferred
    authentication plug-ins
    - debian/patches/CVE-2022-0547.patch: disallow multiple deferred
      authentication plug-ins in doc/man-sections/plugin-options.rst,
      src/openvpn/plugin.c.
    - CVE-2022-0547

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 22 Mar 2022 10:37:55 -0400

openvpn (2.5.5-1ubuntu1) jammy; urgency=medium

  * Merge with Debian unstable (LP: #1946884). Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)
    - d/p/openvpn-fips-2.4.patch: Allow MD5 for PRF in FIPS mode openssl.
    - d/p/OpenSSL3.patch: work around the deprecated algorithm mismatch between
      the OpenSSL3 branch and the OpenVPN 2.5 branch (LP #1945980)

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Wed, 23 Feb 2022 10:14:27 -0500

openvpn (2.5.5-1) unstable; urgency=medium

  [ Jörg Frings-Fürst ]
  * New upstream version 2.5.5
  * Declare compliance with Debian Policy 4.6.0.1
  * d/copyright:
    - Remove duplicate entries;
    - Refresh for new upstream release
    - Add 2021 to myself

  [ Bernhard Schmidt ]
  * Refresh patches for new upstream version

 -- Bernhard Schmidt <berni@debian.org>  Mon, 21 Feb 2022 12:05:55 +0100

openvpn (2.5.1-3ubuntu5) jammy; urgency=medium

  * No-change rebuild to update maintainer scripts, see LP: 1959054

 -- Dave Jones <dave.jones@canonical.com>  Wed, 16 Feb 2022 17:16:30 +0000

openvpn (2.5.1-3ubuntu4) jammy; urgency=medium

  * d/p/OpenSSL3.patch: work around the deprecated algorithm mismatch between
    the OpenSSL3 branch and the OpenVPN 2.5 branch (LP: #1945980)

 -- Simon Chopin <simon.chopin@canonical.com>  Thu, 18 Nov 2021 15:05:21 +0100

openvpn (2.5.1-3ubuntu3) jammy; urgency=medium

  * No-change rebuild against openssl3

 -- Simon Chopin <simon.chopin@canonical.com>  Wed, 01 Dec 2021 16:09:52 +0000

openvpn (2.5.1-3ubuntu2) impish; urgency=medium

  * No-change rebuild to build packages with zstd compression.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 07 Oct 2021 12:21:59 +0200

openvpn (2.5.1-3ubuntu1) impish; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)
    - d/p/openvpn-fips-2.4.patch: Allow MD5 for PRF in FIPS mode openssl.
  * Dropped changes:
    - d/t/server-setup-*: adapt tests to output of v2.5.0
      [Included in 2.5.1-3]

 -- Utkarsh Gupta <utkarsh.gupta@canonical.com>  Mon, 17 May 2021 14:38:17 +0530

openvpn (2.5.1-3) unstable; urgency=medium

  * Fix autopkgtest (Closes: #983662)
    - adapt autopkgtest output to 2.5 (from Ubuntu)
    - Fix easyrsa batch mode invocation
  * Cherry-Pick "Fix condition to generate session keys" (Closes: #988478)

 -- Bernhard Schmidt <berni@debian.org>  Fri, 14 May 2021 09:40:04 +0200

openvpn (2.5.1-2ubuntu1) impish; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)
    - d/p/openvpn-fips-2.4.patch: Allow MD5 for PRF in FIPS mode openssl.
    - d/t/server-setup-*: adapt tests to output of v2.5.0

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Mon, 03 May 2021 17:56:39 -0300

openvpn (2.5.1-2) unstable; urgency=high

  * Cherry-Pick 3 (+ 1 predependency) patches from upstream to fix
    authentication bypass with deferred authentication
    (CVE-2020-15078) (Closes: #987380)

 -- Bernhard Schmidt <berni@debian.org>  Wed, 28 Apr 2021 14:41:58 +0200

openvpn (2.5.1-1ubuntu1) hirsute; urgency=medium

  * Merge with Debian unstable (LP: #1917438). Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)
    - d/p/openvpn-fips-2.4.patch: Allow MD5 for PRF in FIPS mode openssl.
      + d/t/server-setup-*: adapt tests to output of v2.5.0

 -- Utkarsh Gupta <utkarsh.gupta@canonical.com>  Tue, 02 Mar 2021 16:35:37 +0530

openvpn (2.5.1-1) unstable; urgency=medium

  * New upstream version 2.5.1 (bugfix release)

 -- Bernhard Schmidt <berni@debian.org>  Wed, 24 Feb 2021 19:54:34 +0100

openvpn (2.5.0-1ubuntu1) hirsute; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)
    - d/p/openvpn-fips-2.4.patch: Allow MD5 for PRF in FIPS mode openssl.
      [updated to match 2.5.0]
  * Dropped changes [in Debian since 2.5~beta3-1]
    - d/tests: add two DEP-8 test cases
      + d/t/server-setup-with-static-key: test the OpenVPN server side setup
        using a static key.
      + d/t/server-setup-with-ca: test the OpenVPN server side setup using a
        CA built with easy-rsa.
    - d/openvpn*.service: Drop reload support from systemd unit files
      (LP #1868127).  The current reload implementation (sending a SIGHUP
      signal to the process) fails, and the difference between reload and
      restart is not clear. Systemd does not require an implementation for
      reload.
  * Added Changes:
    - d/t/server-setup-*: adapt tests to output of v2.5.0

 -- Christian Ehrhardt <christian.ehrhardt@canonical.com>  Tue, 01 Dec 2020 16:15:12 +0100

openvpn (2.5.0-1) unstable; urgency=medium

  * New upstream version 2.5.0 - final release

 -- Bernhard Schmidt <berni@debian.org>  Wed, 28 Oct 2020 19:37:34 +0100

openvpn (2.5~rc3-1) unstable; urgency=medium

  * New upstream version 2.5~rc3

 -- Bernhard Schmidt <berni@debian.org>  Tue, 20 Oct 2020 19:17:43 +0200

openvpn (2.5~rc2-1) unstable; urgency=medium

  * Downgrade debhelper-compat to 12 for easier backports
  * New upstream version 2.5~rc2

 -- Bernhard Schmidt <berni@debian.org>  Wed, 30 Sep 2020 21:12:11 +0200

openvpn (2.5~beta3-1) unstable; urgency=medium

  * Release to unstable.

  [ Lucas Kanashiro ]
  * Add two DEP-8 test cases for the server side
  * Drop reload support from systemd unit files (LP: #1868127)

  [ Bernhard Schmidt ]
  * Revert "d/gbp.conf for experimental 2.5 branch"
  * New upstream version 2.5~beta3

 -- Bernhard Schmidt <berni@debian.org>  Tue, 01 Sep 2020 16:53:43 +0200

openvpn (2.5~beta1-3) experimental; urgency=medium

  * Disable iproute2 support in favour of the new netlink based default.
    Thanks to Fabio Pedretti

 -- Bernhard Schmidt <berni@debian.org>  Sun, 16 Aug 2020 14:04:11 +0200

openvpn (2.5~beta1-2) experimental; urgency=medium

  * Set Build-Conflicts: systemctl, see Bug#959828

 -- Bernhard Schmidt <berni@debian.org>  Sun, 16 Aug 2020 10:33:47 +0200

openvpn (2.5~beta1-1) experimental; urgency=medium

  * d/gbp.conf for experimental 2.5 branch
  * New upstream version 2.5~beta1
  * Adjust patches for new major upstream version
  * Add python3-docutils to build-depends for manpage generation

 -- Bernhard Schmidt <berni@debian.org>  Sat, 15 Aug 2020 21:32:49 +0200

openvpn (2.4.9-3ubuntu1) groovy; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)
    - d/p/openvpn-fips-2.4.patch: Allow MD5 for PRF in FIPS mode openssl.
    - d/tests: add two DEP-8 test cases
      + d/t/server-setup-with-static-key: test the OpenVPN server side setup
        using a static key.
      + d/t/server-setup-with-ca: test the OpenVPN server side setup using a
        CA built with easy-rsa.
    - d/openvpn*.service: Drop reload support from systemd unit files
      (LP #1868127).  The current reload implementation (sending a SIGHUP
      signal to the process) fails, and the difference between reload and
      restart is not clear. Systemd does not require an implementation for
      reload.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Tue, 18 Aug 2020 08:42:11 -0300

openvpn (2.4.9-3) unstable; urgency=medium

  [ Jörg Frings-Fürst ]
  * Fix the bug that occurs during the update (Closes: #959464):
    "ERROR: Cannot ioctl TUNSETIFF tunX: Device or resource busy (errno=16)"
    - debian/rules: Change dh_installsystemd from "--restart-after-upgrade" to
      "--no-restart-after-upgrade -r".
    - Remove restart from debian/postinst.
    - Add hint to reboot if openvpn is running.
    - Add new chapter into debian/NEWS.
  * Migrate to debhelper 13.
  * debian/postinst:
    - Remove now useless code for version less than 2.3.2-6.
  * debina/copyright:
    - Add year 2020 to Bernhard Schmidt.

 -- Jörg Frings-Fürst <debian@jff.email>  Sat, 02 May 2020 18:14:36 +0200

openvpn (2.4.9-2ubuntu2) groovy; urgency=medium

  * Drop reload support from systemd unit files (LP: #1868127)

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Tue, 26 May 2020 19:04:33 -0300

openvpn (2.4.9-2ubuntu1) groovy; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP 1454725)
    - Allow MD5 for PRF in FIPS mode openssl.
  * Added changes:
    - d/tests: add two DEP-8 test cases
      + d/t/server-setup-with-static-key: test the OpenVPN server side setup
        using a static key.
      + d/t/server-setup-with-ca: test the OpenVPN server side setup using a
        CA built with easy-rsa.

 -- Lucas Kanashiro <lucas.kanashiro@canonical.com>  Wed, 29 Apr 2020 15:35:56 -0300

openvpn (2.4.9-2) unstable; urgency=medium

  * Cherry-Pick upstream patch to fix ssl_do_config error with
    invalid OpenSSL system configuration (Closes: #958296)
    Thanks to Jonas Andradas for reporting and Arne Schwabe for debugging.
  * Use DEB_HOST_MULTIARCH for libraries (Closes: #958315)
  * Enable Salsa CI

 -- Bernhard Schmidt <berni@debian.org>  Tue, 21 Apr 2020 21:58:53 +0200

openvpn (2.4.9-1) unstable; urgency=medium

  [ Jörg Frings-Fürst ]
  * New upstream release (Closes: #950610).
  * Refresh debian/patches/openvpn-pkcs11warn.patch.
  * Remove upstream applied fix-pkcs11-helper-hang.patch.
  * Add libp11-kit-dev to Build - Depends (Closes: #940727).
  * Add symlinks for plugins into /usr/lib/openvpn/ (Closes: #946348).
  * Declare compliance with Debian Policy 4.5.0 (No changes needed).
  * Switch to debhelper-compat:
    - debian/control: change to debhelper-compat (=12).
    - remove debian/compat.
  * debian/copyright:
    - Add year 2020 to debian/*.
    - Add year 2019 to *.
  * debian/control:
    - Add Rules-Requires-Root: No.

  [ Bernhard Schmidt ]
  * New upstream version 2.4.9
    - CVE-2020-11810
      illegal client float can break VPN session for other users

 -- Bernhard Schmidt <berni@debian.org>  Sun, 19 Apr 2020 15:52:57 +0200

openvpn (2.4.7-1ubuntu2) eoan; urgency=medium

  * No-change upload with strops.h and sys/strops.h removed in glibc.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 05 Sep 2019 11:05:25 +0000

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog openvpn`.
