openvpn (2.7.3-1ubuntu2) stonking; urgency=medium

  * Fixup the server-dco test, the string changed in recent versions

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Tue, 16 Jun 2026 11:51:05 +0200

openvpn (2.7.3-1ubuntu1) stonking; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Simon Quigley <tsimonq2@debian.org>  Sat, 02 May 2026 12:29:49 -0500

openvpn (2.7.3-1) unstable; urgency=medium

  * New upstream version 2.7.3
    - in combination with ``--management-query-passwords``, setups using
      ``--auth-user-pass file`` or inline ``auth-user-pass`` would no longer
      use the configured passwords and prompt on the management interface
      instead (OpenVPN GUI would then provide an empty user/password prompt)

 -- Bernhard Schmidt <berni@debian.org>  Mon, 27 Apr 2026 23:25:11 +0200

openvpn (2.7.2-1) unstable; urgency=high

  * New upstream version 2.7.2
    - CVE-2026-40215: fix race condition in TLS handshake that could lead to
      leaking of packet data from a previous handshake under specific
      circumstances
    - CVE-2026-35058: fix server ASSERT() on receiving a suitably malformed
      packet with a valid tls-crypt-v2 key

 -- Bernhard Schmidt <berni@debian.org>  Wed, 22 Apr 2026 22:40:54 +0200

openvpn (2.7.1-1) unstable; urgency=medium

  [ Bernhard Schmidt ]
  * New upstream version 2.7.1 (Closes: #1128493, #1129362)
  * d/openvpn@.service: Adjust to upstream units
    - Increase TasksMax from 10 to 20

  [ Yangfl ]
  * Add zh_CN/zh_TW translation (Closes: #1124417)

 -- Bernhard Schmidt <berni@debian.org>  Thu, 02 Apr 2026 00:36:48 +0200

openvpn (2.7.0-1ubuntu1) resolute; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Thu, 12 Feb 2026 14:06:21 +0100

openvpn (2.7.0-1) unstable; urgency=medium

  * Change maintainer to group address, add Marc Haber as Uploader
  * New upstream version 2.7.0

 -- Bernhard Schmidt <berni@debian.org>  Thu, 12 Feb 2026 09:45:29 +0100

openvpn (2.7.0~rc6-1ubuntu1) resolute; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Tue, 03 Feb 2026 08:15:51 +0100

openvpn (2.7.0~rc6-1) unstable; urgency=medium

  [ Bernhard Schmidt ]
  * New upstream version 2.7.0~rc6
  * Use d/watch version 5
  * Update Standards-Version: 4.7.3, drop Priority field

  [ Gianfranco Costamagna ]
  * Autopkgtests fixes:
    - Fix test server-setup-with-ca, by making sure new DCO mode
      is not used (fails grep command otherwise)
    - Relax regex for TUN/TAP and check after the loop which device was opened
    - Add new allow-deprecated-insecure-static-crypto flag to
      server-setup-with-static-key to allow the test run in deprecated mode
    - Add dump of log file in case of failures to better check which
      output didn't match
    - Fixup test, some logs were removed in new openvpn version
    - Run tests in isolation-container not in isolation-machine
    - Add new server-setup-with-ca-dco test, skippable for now since not all
      the kernels supports this new way of opening an openvpn tunnel
    - Add code to skip the test if /dev/net/tun is not there
    - Use AUTOPKGTEST_ARTIFACTS instead of AUTOPKGTEST_TMP, so we don't
      have to dump openvpn.log file but we can have in artifacts tarball

 -- Bernhard Schmidt <berni@debian.org>  Sun, 01 Feb 2026 22:24:28 +0100

openvpn (2.7.0~rc5-1ubuntu5) resolute; urgency=medium

  * Fix tests (LP: #2135125):
    - disable DCO for normal ca test
    - add new test for DCO
    - allow unsecure crypto for static key test
    - don't check anymore if the route is properly configured, message not
      printed anymore
    - dump openvpn log before cleaning up

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Fri, 23 Jan 2026 08:20:15 +0100

openvpn (2.7.0~rc5-1ubuntu1) resolute; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)
    - d/t/control: Move to isolation-container to enable armhf/LXD coverage.
      (LP #2104146)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Thu, 22 Jan 2026 18:49:46 +0100

openvpn (2.7.0~rc5-1) unstable; urgency=medium

  [ Bernhard Schmidt ]
  * New upstream version 2.7.0~rc5
    - CVE-2025-15497: in epoch key handling (an authenticated remote system can
      send a valid OpenVPN data packet that triggers an endge case where a
      too-strict check would trigger an ASSERT(), exiting OpenVPN)

  [ Luca Boccassi ]
  * d/postinst: do not fail if pidof is not available

 -- Bernhard Schmidt <berni@debian.org>  Fri, 16 Jan 2026 10:15:07 +0100

openvpn (2.7.0~rc4-1) unstable; urgency=medium

  * New upstream version 2.7.0~rc4
  * debian/openvpn@.service: Follow upstream change to add CAP_SYS_NICE
  * Fix build-depends-on-obsolete-package pkg-config => pkgconf
  * Fix d/copyright lintian warnings

 -- Bernhard Schmidt <berni@debian.org>  Fri, 19 Dec 2025 15:47:09 +0100

openvpn (2.7.0~rc3-1) unstable; urgency=medium

  * New upstream version 2.7.0~rc3
    - DCO (primarily Linux): improve handling of bulk notifications from
      kernel (do not lose notifications, do not crash) (github#900)

 -- Bernhard Schmidt <berni@debian.org>  Sat, 29 Nov 2025 00:21:01 +0100

openvpn (2.7.0~rc2-2) unstable; urgency=medium

  * New upstream version 2.7.0~rc2 to unstable
    - CVE-2025-12106
      IPv6 address parsing: fix buffer overread on invalid input
    - CVE-2025-13086
      HMAC verification check: fix incorrect memcmp() call (Closes: #1121086)

  * Highlights from the 2.7 upstream release
    - Multi-socket support for servers -- Handle multiple
      addresses/ports/protocols within one server
    - Support for new upstream DCO Linux kernel module
      + replaces previous ovpn-dco-v2 out-of-tree kernel module with an
        official kernel module available since Linux 6.16+

 -- Bernhard Schmidt <berni@debian.org>  Thu, 20 Nov 2025 23:31:00 +0100

openvpn (2.6.15-1ubuntu1) resolute; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)
    - d/t/control: Move to isolation-container to enable armhf/LXD coverage.
      (LP #2104146)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Mon, 27 Oct 2025 18:54:34 +0100

openvpn (2.6.15-1) unstable; urgency=medium

  * New upstream version 2.6.15 (Closes: #1118074)
    - Drop Kernel 6.16+ fix applied upstream

 -- Bernhard Schmidt <berni@debian.org>  Sun, 26 Oct 2025 16:32:43 +0100

openvpn (2.6.14-2ubuntu1) questing; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)
    - d/t/control: Move to isolation-container to enable armhf/LXD coverage.
      (LP #2104146)
    - d/p/handle_intentional_route_push_float_ip.patch

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Sat, 06 Sep 2025 08:40:39 +0200

openvpn (2.6.14-2) unstable; urgency=medium

  * Cherry-pick upstream fix to build with Kernel 6.16+ (Closes: #1114249)
  * d/control: Set homepage to the community (open-source) subpage

 -- Bernhard Schmidt <berni@debian.org>  Fri, 05 Sep 2025 22:13:12 +0200

openvpn (2.6.14-1ubuntu2) questing; urgency=medium

  * d/p/handle_intentional_route_push_float_ip.patch: Fix floating IP due
    to "route VPN_IP net_gateway", which can lead to incorrect blocking of
    a source IP switch for 60 seconds immediately after connection setup.
    (LP: #2108860)

 -- Bryce Harrington <bryce@canonical.com>  Thu, 28 Aug 2025 15:34:24 -0700

openvpn (2.6.14-1ubuntu1) questing; urgency=medium

  * Merge from Debian Unstable (LP: #2110417). Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)
    - d/t/control: Move to isolation-container to enable armhf/LXD coverage.
      (LP #2104146)
  * Dropped Changes:
    - SECURITY UPDATE: denial of service issue
      + debian/patches/CVE-2025-2704.patch: allow tls-crypt-v2 to be setup
        only on initial packet of a session in src/openvpn/ssl.c,
        src/openvpn/ssl_common.h, src/openvpn/ssl_pkt.c,
        src/openvpn/ssl_pkt.h, src/openvpn/tls_crypt.c,
        src/openvpn/tls_crypt.h, tests/unit_tests/openvpn/test_tls_crypt.c.
      + CVE-2025-2704
      [ Fixed upstream in 2.6.14 ]

 -- Lena Voytek <lena.voytek@canonical.com>  Wed, 21 May 2025 13:13:19 -0400

openvpn (2.6.14-1) unstable; urgency=medium

  [ Aquila Macedo ]
  * Add new autopkgtest for unit tests

  [ Bernhard Schmidt ]
  * New upstream version 2.6.14
    - CVE-2025-2704 possible ASSERT() on OpenVPN servers using --tls-crypt-v2
      (Closes: #1101935)

 -- Bernhard Schmidt <berni@debian.org>  Wed, 02 Apr 2025 20:56:44 +0200

openvpn (2.6.13-1ubuntu3) plucky; urgency=medium

  * SECURITY UPDATE: denial of service issue
    - debian/patches/CVE-2025-2704.patch: allow tls-crypt-v2 to be setup
      only on initial packet of a session in src/openvpn/ssl.c,
      src/openvpn/ssl_common.h, src/openvpn/ssl_pkt.c,
      src/openvpn/ssl_pkt.h, src/openvpn/tls_crypt.c,
      src/openvpn/tls_crypt.h, tests/unit_tests/openvpn/test_tls_crypt.c.
    - CVE-2025-2704

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 01 Apr 2025 12:03:56 -0400

openvpn (2.6.13-1ubuntu2) plucky; urgency=medium

  * d/t/control: Move to isolation-container to enable armhf/LXD coverage.
    (LP: #2104146)

 -- Lukas Märdian <slyon@ubuntu.com>  Tue, 25 Mar 2025 14:47:41 +0100

openvpn (2.6.13-1ubuntu1) plucky; urgency=medium

  * Merge from Debian Unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Simon Quigley <tsimonq2@ubuntu.com>  Mon, 10 Feb 2025 22:24:50 -0600

openvpn (2.6.13-1) unstable; urgency=medium

  * New upstream version 2.6.13 (Closes: #1095675)

 -- Bernhard Schmidt <berni@debian.org>  Mon, 10 Feb 2025 22:09:11 +0100

openvpn (2.6.12-1ubuntu1) oracular; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Fri, 19 Jul 2024 17:47:31 +0200

openvpn (2.6.12-1) unstable; urgency=medium

  * New upstream version 2.6.12
    - Fix regression in CVE-2024-5594 patch breaking user configurations with
      AUTH_FAIL messages having trailing CR/NL characters. This often happens
      if the AUTH_FAIL reason is set by a script

 -- Bernhard Schmidt <berni@debian.org>  Thu, 18 Jul 2024 23:30:00 +0200

openvpn (2.6.11-1ubuntu1) oracular; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Mon, 08 Jul 2024 15:42:17 +0200

openvpn (2.6.11-1) unstable; urgency=medium

  * New upstream version 2.6.11 (Closes: #1074488)
    - CVE-2024-28882
      client can circumvent management client-kill
    - CVE-2024-5594
      malicious peer can DoS or send garbage to logs
  * d/openvpn@.service: Add CAP_SETPCAP required for openvpn-dco-dkms
    (Closes: #1074504)
  * drop d/patches/systemd.patch, applied upstream

 -- Bernhard Schmidt <berni@debian.org>  Mon, 08 Jul 2024 00:06:59 +0200

openvpn (2.6.10-0ubuntu1) oracular; urgency=medium

  * New upstream version 2.6.10 (LP: #2064436)
    - Updates:
      + t_client.sh can now run pre-tests and skip a test block if needed.
      + Remove license warnings about mbedTLS linking.
      + Update documentation references in systemd unit files.
      + Remove obsolete tls-*.conf sample files.
      + document that auth-user-pass may be inlined.
    - Bug fixes:
      + Fix checking option consistency for compiled-in compression algorithm
        support.
      + Remove obsolete syslog.target in systemd unit files.
      + Additional Windows bug fixes.
    - See https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn26 for
      additional bug fixes and information.
  * d/p/systemd.patch: Remove - Fixed upstream

 -- Lena Voytek <lena.voytek@canonical.com>  Wed, 01 May 2024 10:02:39 -0700

openvpn (2.6.9-1ubuntu4) noble; urgency=high

  * No change rebuild against libssl3t64.

 -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 08 Apr 2024 16:47:03 +0200

openvpn (2.6.9-1ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 09:23:46 +0000

openvpn (2.6.9-1ubuntu2) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Mar 2024 20:31:57 +0000

openvpn (2.6.9-1ubuntu1) noble; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Thu, 29 Feb 2024 17:22:31 +0100

openvpn (2.6.9-1) unstable; urgency=medium

  * New upstream version 2.6.9
  * Switch to systemd-dev (Closes: #1060500)
  * Install systemd generator and units into /usr. (Closes: #1064399)

 -- Bernhard Schmidt <berni@debian.org>  Wed, 28 Feb 2024 08:43:25 +0100

openvpn (2.6.7-1ubuntu1) noble; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: Demote easy-rsa to Suggests (universe package).
    - debian/openvpn@.service: Add '--script-security 2' similar to what
      got added to debian/openvpn.init.d ages ago (LP #1454725)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Mon, 13 Nov 2023 18:36:03 +0100

openvpn (2.6.7-1) unstable; urgency=medium

  [ Aquila Macedo ]
  * d/control: bump debhelper-compat level to 13.
  * d/patches: Remove outdated patches
  * d/patches: fix typo in openvpn binary
  * d/patches: fix typo in manpages
  * d/copyright: Update license to BSD-2
  * d/openvpn.service: add documentation

  [ Bernhard Schmidt ]
  * New upstream version 2.6.7, fixing two CVEs (Closes: #1055805)
    - CVE-2023-46849: Use of --fragment option can lead to a division by zero
      error which can be fatal
    - CVE-2023-46850: Incorrect use of send buffer can cause memory to be sent
      to peer
  * Pick patch recommended by upstream in GH#449 to fix segfault
    introduced in 2.6.7

  [ Remus-Gabriel Chelu ]
  * Add Romanian templates translation (Closes: #1033179)

 -- Bernhard Schmidt <berni@debian.org>  Sat, 11 Nov 2023 22:01:15 +0100

openvpn (2.6.5-0ubuntu1) mantic; urgency=medium

  * New Upstream release 2.6.5 (LP: #2018095)
  * d/p/fix-dangling-pointer-in-pkcs11.patch:
    Remove - fixed upstream in 2.6.4
  * d/p/fix-memleak-in-dco_get_peer_stats_multi.patch:
    Remove - fixed upstream in 2.6.5

 -- Lena Voytek <lena.voytek@canonical.com>  Tue, 11 Jul 2023 09:36:08 -0700

openvpn (2.6.3-2.1) unstable; urgency=medium

  * Non-maintainer upload.

  [ Helmut Grohne ]
  * Do not install systemd units twice (Closes: #1054083)

 -- Jochen Sprickerhof <jspricke@debian.org>  Fri, 27 Oct 2023 16:26:34 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog openvpn`.
