Home A - Z
Page Index

An Otter Wiki

Commit 8b6955

2026-08-05 14:28:29 flichtenheld: 2.7.6
Downloads.md ..
@@ 1,127 1,86 @@
- ## OpenVPN 2.7.5 -- Released 1 July 2026
- The OpenVPN community project team is proud to release OpenVPN 2.7.5. This is a bugfix release fixing
+ ## OpenVPN 2.7.6 -- Released 5 August 2026
+ The OpenVPN community project team is proud to release OpenVPN 2.7.6. This is a bugfix release fixing
several security issues.
- For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7.5/Changes.rst)
+ For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7.6/Changes.rst)
Security fixes:
- - openvpnserv (windows): fix DNS SearchList state pollution on (dis)connect.
- specific combinations of `--dns` config entries plus local DNS config
- could lead to corruption of pre-openvpn DNS config ([CVE-2026-13379](https://www.cve.org/CVERecord?id=CVE-2026-13379))
-
- Bug found by 章鱼哥 (www.aipyaipy.com).
+ - openvpnserv (windows): better scrutinize command line passed in
+ from the control socket to openvpn. This would lead to circumventing
+ admin restrictions on allowed openvpn config directories (but never
+ to "read files the user has no permissions for") ([CVE-2026-63649](https://www.cve.org/CVERecord?id=CVE-2026-63649))
- - Fix use-after-free bug in ack_write_buf(), triggerable by a well-timed
- sequence of control channel + authentication packets ([CVE-2026-12996](https://www.cve.org/CVERecord?id=CVE-2026-12996))
-
- Bug found by multiple researchers:
- - 章鱼哥 (www.aipyaipy.com)
- - Haiyang Huang
- - Haruki Oyama (Waseda University)
+ Bug found by 章鱼哥 (www.aipyaipy.com)
- - Fix use-after-free bug in tls_wrap_reneg(), triggerable by suitable
- sequence of dynamic tls-crypt control-channel packets ([CVE-2026-13117](https://www.cve.org/CVERecord?id=CVE-2026-13117))
-
- Bug found by multiple researchers:
- - Trace37 Labs (github.com/trace37labs)
- - Haiyang Huang
+ - dco: make key state desync recoverable
- - Fix server crash on reception of suitably malformed auth-token, if
- `--auth-gen-token external-auth` is active ([CVE-2026-13122](https://www.cve.org/CVERecord?id=CVE-2026-13122))
-
- Bug found by Haiyang Huang.
+ This was reported as a "with suitable timing, a key-update de-sync between
+ OpenVPN and the kernel could trigger an ASSERT()", and was initially
+ handled as security report. It turned out to be not exploitable, but the
+ state machine was not very robust and so the opportunity was used to
+ improve the code.
- - Fix memory-leak in tls-crypt-v2 client key handling that could lead
- to out-of-memory situations and subsequent server crashes ([CVE-2026-12932](https://www.cve.org/CVERecord?id=CVE-2026-12932))
-
- Bug found by Valton Tahiri.
+ Bug found by 章鱼哥 (www.aipyaipy.com)
- - Fix possible 1-byte buffer overrun on NTLMv2 proxy responses.
- ([CVE-2026-11771](https://www.cve.org/CVERecord?id=CVE-2026-11771))
-
- Bug found by Tristan Madani (@TristanInSec).
+ - make ``--x509-username-field`` work with mbedTLS.
- - Fix another memory leak on reception of suitable tls-crypt-v2 packets
- that could lead to an out of memory situation and server crash
- ([CVE-2026-13698](https://www.cve.org/CVERecord?id=CVE-2026-13698))
-
- Bug found by Max Fillinger. Overlaps with a report
- from Valton Tahiri that we believe to
- be fixed by this bugfix as well.
-
- Bugfixes:
-
- - Windows: fix plugin trusted-dir check prefix bypass
- (this fixes a bug in the path checking logic we do on Windows for
- "is loading a plugin from this path allowed?", but since we could
- not find a way to exploit this unless starting with admin privs or
- a social engineering attack, not classified as a security fix)
-
- - Windows: openvpnserv: rework ConvertItfDnsDomains and tests
- (this fixes a buffer overread that is not exploitable and as such
- not classified as security fix)
+ In very particular setups, together with a CA creating matching certificates,
+ this could lead to unintentionally permitting a certificate that should
+ not have. This is why this was considered a (low-prio) security bug and a
+ CVE ID was assigned ([CVE-2026-63650](https://www.cve.org/CVERecord?id=CVE-2026-63650))
- - options: fix use-after-free of DNS options on client connect
- (using suitable `--dns` or `--dhcp-option DNS` options in a server
- config - not pushed, but applying to the server itself - triggers a
- double free() and use-after-free condition, possibly crashing the
- server) (Github: [OpenVPN/openvpn#1060](https://github.com/OpenVPN/openvpn/issues/1060))
+ Bug found by 章鱼哥 (www.aipyaipy.com)
- - dns: Fix memory leak in dns_server_addr_parse, if too many server
- addresses are configured (Github: [OpenVPN/openvpn#1055](https://github.com/OpenVPN/openvpn/issues/1055))
+ User-visible Changes:
- - improve multi-socket event handling further - multiple open UDP sockets
- with concurrent traffic could lead to inefficient processing, and the
- old code was also very hard to follow.
+ - if `--dev` is not specified, default to `--dev tun` - so for the
+ tun case, this option can now be left out of the openvpn config.
- (This was initially triggered by a report from Joshua Rogers using ZeroPath,
- but turned out to be "just bad code" not a security vulnerability)
+ - `--ping` and `--keepalive` settings are now limited to 24 hours
+ maximum - the primary reason for that is to avoid lots of extra code
+ in the DCO kernel to handle arbitrarily large values without overflowing
+ 32 bit integers. 24h is considered much higher than any reasonable use.
- - Null-terminate tls-crypt client keys when testing - non-exploitable
- strlen() on a buffer that is not null-terminated
+ - The `TCP_NODELAY` socket flag is now "always on". The `--tcp-nodelay`
+ option is kept, because setting it on a p2mp server also enables pushing
+ of `socket-flags TCP_NODELAY` to clients, which might not have this
+ code change yet.
- - mudp: send HMAC reset reply synchronously
- this fixes a bug where multiple incoming tls-crypt-v2 RESET packets
- on different sockets could end up overwriting each other's control
- structures, leading to initial handshake packets (HMAC reset reply)
- being sent to the wrong client IP, or on a non-suitable socket
- ("v4 packet on a v6 socket"). Since the overall flow here is stateless
- by nature, do not artificially create state by creating elaborate
- queues, just send-or-drop.
+ - Remove `--providers` from `--help` output on mbedTLS builds.
- - fix port-share and multi-socket interaction - port-share needs TCP
- listeners, but the check was wrong. So "as long as any of the listening
- sockets is TCP, port-share can be used" (Github: [OpenVPN/openvpn#1027](https://github.com/OpenVPN/openvpn/issues/1027))
+ Bugfixes:
- - Ensure pushed tun-mtu is no lower than TUN_MTU_MIN - this fixes a bug
- where a server can push a suitable combination of options and make the
- client ASSERT().
+ - refuse incoming HARD RESET packets with a sequence ID != 0
+ (this is basically making an OpenVPN server ignore and log a
+ "should never happen" client-side misbehaviour, which could lead to
+ TLS handshake establishment failures in p2p TLS setups)
- (Reported as security issue by Haiyang Huang,
- but it was decided that the server always has means to make the client
- "not function properly", and it can not be exploited beyond that)
+ - correctly calculate packet id size if epoch packet format is in use -
+ this was off by 4, for connections openvpn 2.7+ to openvpn 2.7+,
+ exceeding "mssfix mtu" headroom by those 4 bytes
+ (Github: [OpenVPN/openvpn#1074](https://github.com/OpenVPN/openvpn/issues/1074))
- - Windows: socket: assert buffer length before reading prepended sockaddr
- family - a misbehaviour in the windows DCO driver could trigger an
- overread in the userland client. No such bug exists, which this was
- not treated as a security vulnerability
+ - correct minimum packet length check for 802.1q tagged packets
+ (Github: [OpenVPN/openvpn#1044](https://github.com/OpenVPN/openvpn/issues/1044)).
- Documentation improvements:
+ This was also reported (twice) as a security bug, as technically
+ OpenVPN with ``--client-nat`` would read and write up to 4 bytes
+ "after the end of the packet" - but due to the OpenVPN packet buffer
+ layouts, which are always full-frame-sized this is fully safe and has
+ no adverse consequences.
- - improve documentation for `--float` (Github: [OpenVPN/openvpn#358](https://github.com/OpenVPN/openvpn/issues/358))
- - add documentation for `--preresolve` (Github: [OpenVPN/openvpn#532](https://github.com/OpenVPN/openvpn/issues/532))
- - impove documentation around DNS config (Github: [OpenVPN/openvpn#937](https://github.com/OpenVPN/openvpn/issues/937))
- Windows MSI changes since 2.7.4-I002:
- * Built against OpenSSL 3.6.3
+ Windows MSI changes since 2.7.5-I001:
+ * Update included dco-win driver to v2.8.4
+ * fix control channel stall (Github: [ovpn-dco-win/issues/137](https://github.com/OpenVPN/ovpn-dco-win/issues/137))
| | | |
|-|-|-|
- |**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.5-I001-amd64.msi.asc)|[OpenVPN-2.7.5-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.5-I001-amd64.msi)|
- |**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.5-I001-arm64.msi.asc)|[OpenVPN-2.7.5-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.5-I001-arm64.msi)|
- |**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.5-I001-x86.msi.asc)|[OpenVPN-2.7.5-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.5-I001-x86.msi)|
- |**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7.5.tar.gz.asc)|[openvpn-2.7.5.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7.5.tar.gz)|
+ |**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.6-I001-amd64.msi.asc)|[OpenVPN-2.7.6-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.6-I001-amd64.msi)|
+ |**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.6-I001-arm64.msi.asc)|[OpenVPN-2.7.6-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.6-I001-arm64.msi)|
+ |**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.6-I001-x86.msi.asc)|[OpenVPN-2.7.6-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.6-I001-x86.msi)|
+ |**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7.6.tar.gz.asc)|[openvpn-2.7.6.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7.6.tar.gz)|
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9