From https://www.openwall.com/lists/oss-security/2025/04/02/5 The OpenVPN community has released OpenVPN 2.6.14 which includes a critical security fix. This issue is fixed in OpenVPN 2.6.14 which has been released today. ----------------------------------------------------------------- CVE-2025-2704: Fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2 OpenVPN servers between 2.6.1 and 2.6.13 using --tls-crypt-v2 can be made to abort with an ASSERT() message by sending a particular combination of authenticated and malformed packets. To trigger the bug, a valid tls-crypt-v2 client key is needed, or network observation of a handshake with a valid tls-crypt-v2 client key. No crypto integrity is violated, no data is leaked, and no remote code execution is possible. This bug does not affect OpenVPN clients. (Bug found by internal QA at OpenVPN Inc) ----------------------------------------------------------------- <https://community.openvpn.net/openvpn/wiki/Downloads#OpenVPN2.6.14--Released02April2025> <https://community.openvpn.net/openvpn/wiki/CVE-2025-2704> <https://www.cve.org/CVERecord?id=CVE-2025-2704>
The title isn't right, as 2.6.14 isn't in-tree.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=38f8330b1908cca1034676a3425a1548388b8b2d commit 38f8330b1908cca1034676a3425a1548388b8b2d Author: Filip Kobierski <fkobi@pm.me> AuthorDate: 2025-04-16 23:41:06 +0000 Commit: Agostino Sarubbo <ago@gentoo.org> CommitDate: 2025-05-14 12:31:35 +0000 net-vpn/openvpn: add 2.6.14 with minor improvements - remove stray / from HOMEPAGE - remove empty strings from ewarn for readabilitys - remove obsolete MacOS ewarn Bug: https://bugs.gentoo.org/953118 Signed-off-by: Filip Kobierski <fkobi@pm.me> Signed-off-by: Agostino Sarubbo <ago@gentoo.org> net-vpn/openvpn/Manifest | 1 + net-vpn/openvpn/openvpn-2.6.14.ebuild | 194 ++++++++++++++++++++++++++++++++++ 2 files changed, 195 insertions(+)
