Home A - Z
Page Index

An Otter Wiki

Commit 86e098

2026-11-05 15:11:51 flichtenheld: 2.7.9
ReleaseHistory.md ..
@@ 1,3 1,179 @@
+ ## OpenVPN 2.7.9 -- Released 5 November 2026
+ The OpenVPN community project team is proud to release OpenVPN 2.7.9. This is a bugfix release fixing
+ several security issues.
+
+ For details see [Changes.md](https://github.com/OpenVPN/openvpn/blob/v2.7.9/Changes.md)
+
+ ### Security fixes
+
+ - win32: restrict loading plugin dependencies (DLLs) to plugin, app
+ and system directories.
+
+ - win32: run openvpn.exe from the interactive service at "high integrity
+ level", that is, process memory of openvpn.exe and all its threads are
+ protected from tampering. Signals/Events are still permitted.
+
+ - win32: openvpnserv: strictly filter user-defined environment variables
+ before passing to openvpn.exe ([CVE-2026-121720](https://www.cve.org/CVERecord?id=CVE-2026-121720))
+
+ (Issue found by Heiko Hund, tracked in
+ Github: OpenVPN/openvpn-private-issues#186)
+
+ - win32: openvpnserv: make validation of openvpn command line more robust
+ to invalid-quoting attacks ([CVE-2026-115342](https://www.cve.org/CVERecord?id=CVE-2026-115342))
+
+ - win32: openvpn.exe: change parsing of commandline to use the same
+ function that the interactive service uses (`CommandLineToArgvW()`)
+ ([CVE-2026-115342](https://www.cve.org/CVERecord?id=CVE-2026-115342))
+
+ (Issues found by Heiko Hund, tracked in
+ Github: OpenVPN/openvpn-private-issues#184)
+
+ ### Bug fixes
+
+ - Username/Password parsing from `--auth-user-pass` file (or inline)
+ left parts of overlong usernames in the password field. Fix.
+ (GH [OpenVPN/openvpn#1140](https://github.com/OpenVPN/openvpn/issues/1140))
+
+ - win32: openvpnserv: fix memory leak for security descriptors
+
+ - win32: repair logging of errors in Windows `tun_read_queue()`
+
+ - win32: avoid accessing uninitialized structure data if `GetInterfaceInfo()`
+ or `GetPerAdapterInfo()` fail
+
+ - win32: openvpnserv: avoid double `free()` if `GetTokenInformation()` fails
+
+ - win32: openvpnserv: avoid potential format-string issue on registry defaults
+
+ - win32: openvpnserv: repair error reporting on `RegGetValueA()` failures
+ inside `GetItfDnsServersV4()`
+
+ - win32: openvpnserv: fix `inet_ntop()` return code check in
+ `GetItfDnsServersV6()`, making it ignore DHCP-provided DNS servers.
+
+ - route: repair printing of ROUTE_GATEWAY/ROUTE6_GATEWAY info - the actual gateway handling was correct, just not
+ printing anything anymore.
+
+ - config: check_file_access: fix `--extra-certs` access check
+
+ - win32: tun: free gc arena in `windows_set_mtu()` (mem leak in error path)
+
+ - route: close socket in Haiku `get_default_gateway()` (FD leak)
+
+ - win32: openvpnserv: skip conversion of empty domain names
+
+ - win32: cmake+mingw: don't prefix the event message DLL with lib
+ (it was building 'libopenvpnservmsg.dll' instead of 'openvpnservmsg.dll')
+
+ - win32: pass the buffer size in bytes to `get_openvpn_reg_value()`
+
+ - PUSH_UPDATE server: free temporary options after sending message (memleak)
+
+
+ ### User-visible Changes
+
+ - Linux: set `IFF_BACKPRESSURE` on Linux (if available)
+
+ This helps the kernel tun/tap to apply proper prioritization (qdisc etc)
+ to incoming packets if userspace is slow to process them. Without the
+ flag, the kernel would just drop everything.
+
+ - Management/GUI: Optionally indicate username in `>PASSWORD '<UP_TYPE>'` prompts
+
+ If an openvpn config has a username set but no password, and OpenVPN
+ wants to prompt for the password, the GUI could not see the username
+ today and prompted for both. With this change, OpenVPN sends a hint to
+ the management interface, so a GUI can pre-fill the username field, or
+ only prompt for the password.
+
+ This is only done if the management interface client announces
+ support for it (compatibility level >= 6).
+
+ ### Code improvements/general hardening
+
+ - crypto_epoch: wipe key material with `secure_memzero()`
+
+ - do not look up "none" cipher in OpenSSL - this avoids leaving an "error"
+ on the OpenSSL error stack, which can then later lead to spurious
+ SSL error prints on CRL loading.
+
+ - Make CRL reload EOF detection independent of stale error queue entries
+ (GH: [OpenVPN/openvpn#1104](https://github.com/OpenVPN/openvpn/issues/1104))
+
+ - tls_crypt: fix handling of "cipher final output" (which is always empty
+ on today's SSL libraries, so no impact today, but might not be in future)
+
+ - crypto: `ASSERT()` opt before first use in `openvpn_decrypt_aead()`
+
+ - auth_token: wipe the server secret key after loading it
+
+ - port-share: do not write journal file through symlinks or hardlinks
+ (and also document how port-share directory should be set up)
+ (GH [OpenVPN/openvpn#1124](https://github.com/OpenVPN/openvpn/issues/1124))
+
+ - dns-updown: close first pipe if creating the second one fails
+ (avoid leaking file descriptors on error)
+
+ - init: check parameters for NULL before strlen() in send_cc_message
+ (not triggerable today)
+
+ - crypto_openssl: Clear PEM decoded key data before freeing it
+
+ - Increase the buffer size for alert-message in management user-pass query
+ (so long usernames can be hinted towards the GUI)
+
+ - win32: openvpnserv: validate message size for dns/nrpt/wins handlers
+ (GH: [OpenVPN/openvpn#1129](https://github.com/OpenVPN/openvpn/issues/1129))
+
+ - win32: plugin: detect too long plugin paths on Windows
+
+ - win32: openvpnserv: null-terminate iface.name in address and route handlers
+ (GH: [OpenVPN/openvpn#1130](https://github.com/OpenVPN/openvpn/issues/1130))
+
+
+ ### Documentation improvements
+
+ - Fix numbering of examples in management-notes.txt
+
+ - Document "notify" as auth pending method
+
+ - Convert Changes.rst to Markdown (2.7)
+
+
+ ### Long-term code maintenance
+
+ - OpenSSL 4.1 compatibility: use `ASN1_STRING_get_length()` now, providing
+ a fallback to `ASN1_STRING_length()` for older SSL libraries.
+
+ - Linux: sitnl: use `RTM_SETLINK` for updating existing interfaces
+ (instead of `RTM_NEWLINK`)
+
+ - gen-sample-keys.sh: Don't apply server extensions to CSRs
+
+ - review all usages of `strncpy()`
+ (change to `strncpynt()`, `memcpy()`, etc. where appropriate)
+
+
+
+ Windows MSI changes since 2.7.8-I001:
+ * Update included openvpn-gui to 11.67
+ * Support username indication in communication with OpenVPN (see above). Prefills the username in prompt to user.
+ (GH: [OpenVPN/openvpn-gui#719](https://github.com/OpenVPN/openvpn/issues/719))
+ * Fix tray tooltip and popup positioning on non-primary monitors
+ (GH: [OpenVPN/openvpn-gui#836](https://github.com/OpenVPN/openvpn/issues/836))
+ * Improve Swedish translation
+ (GH: [OpenVPN/openvpn-gui#828](https://github.com/OpenVPN/openvpn/pull/828))
+
+ | | | |
+ |-|-|-|
+ |**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.9-I001-amd64.msi.asc)|[OpenVPN-2.7.9-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.9-I001-amd64.msi)|
+ |**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.9-I001-arm64.msi.asc)|[OpenVPN-2.7.9-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.9-I001-arm64.msi)|
+ |**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.9-I001-x86.msi.asc)|[OpenVPN-2.7.9-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.9-I001-x86.msi)|
+ |**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7.9.tar.gz.asc)|[openvpn-2.7.9.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7.9.tar.gz)|
+
+ For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
+
## OpenVPN 2.7.8 -- Released 7 October 2026
The OpenVPN community project team is proud to release OpenVPN 2.7.8. This is a bugfix release fixing
several security issues.
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9