Bugzilla Bug 111116

Looking at this advisory : http://www.frsirt.com/bulletins/2510
OpenVPN <= 2.0.2 has 2 vulnerabilities.
Please bump to 2.0.3 as quick as possible

Regards

Ccing rest of herd as luckyduck has been away for some time. Please bump to
2.0.3.

Adding myself as I've been looking after openvpn due to a (now solved)
baselayout-1.12.0_pre issue as luckyduck is away (for long time) and warpzero is
no longer a dev (iirc)

Koon, openvpn-2.0.3 isn't released yet and has no source tarball or any 2.0.3
download available from their site.

They pulled the release, probably needs a small last-minute fix.

Are we talking abour 2.0.3 or 2.0.4 ?

Are we talking abour 2.0.3 or 2.0.4 ?

OK, 2.0.3 was released this morning then removed a few hours after...
Now 2.0.4 is released with the correct fixes (see http://openvpn.net/changelog.html)

So now bump is for 2.0.4 skipping 2.0.3 ;)

2.0.4 is now in the tree

Arches please test and mark 2.0.4 stable
Target KEYWORDS="alpha amd64 ppc ppc-macos sparc x86"

x86 stable

Stable on ppc.

2.0.4 removed as to having the new init script
2.0.4-r1 added with old script - please mark this version stable
2.0.4-r2 has the new init script

Sorry for any confusion/problems/whatever

2.0.4-r1 stable on ppc-macos

sparc stable.

openvpn-2.0.5 just got released with fixes another serious issue
I've just comitted it to the tree, fixing bug #111369, marked ~ARCH

The 2.0.4 ebuilds are still there, but are un-useable on Linux.
ChangeLog snippet

* Fixed bug in Linux get_default_gateway function
  introduced in 2.0.4, which would cause redirect-gateway
  on Linux clients to fail.
* Restored easy-rsa/2.0 tree (backported from 2.1 beta
  series) which accidentally disappeared in
  2.0.2 -> 2.0.4 transition.

I'll leave it upto you guys if you want to stable 2.0.5 as technically 2.0.4 has
the security fix but as the openvpn guys said, it may be unuseable.

Uh - if this goes stable, then mark 2.0.5 stable and NOT 2.0.5-r1 which has the
new init script

We should definitely have 2.0.5 stable rather than 2.0.4...

Upstream really fucked up this release big time.
Readding arches that already tested 2.0.4...

Stable on ppc.

x86 done

ppc-macos done

sparc stable, let's hope it's the last one.

Alpha stable.

amd64 stable, sorry for the delay

GLSA 200511-07