-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 01 Jul 2026 22:20:55 +0200
Source: openvpn
Architecture: source
Version: 2.6.14-1+deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: Bernhard Schmidt <berni@debian.org>
Changed-By: Bernhard Schmidt <berni@debian.org>
Changes:
openvpn (2.6.14-1+deb13u3) trixie-security; urgency=high
.
* Cherry-pick upstream security patches from the 2.6.21 release
- CVE-2026-12996: Fix use-after-free bug in ack_write_buf(), triggerable by
a well-timed sequence of control channel + authentication packets
- CVE-2026-13117: Fix use-after-free bug in tls_wrap_reneg(), triggerable
by suitable sequence of dynamic tls-crypt control-channel packets
- CVE-2026-13122: Fix server crash on reception of suitably malformed
auth-token, if --auth-gen-token external-auth is active
- CVE-2026-12932: Fix memory-leak in tls-crypt-v2 client key handling that
could lead to out-of-memory situations and subsequent server crashes
- CVE-2026-11771: Fix possible 1-byte buffer overrun on NTLMv2 proxy
responses.
- CVE-2026-13698: Fix another memory leak on reception of suitable
tls-crypt-v2 packets that could lead to an out of memory situation and
server crash
Checksums-Sha1:
096f3a33108fdebd05def06d18c97d50a8c50a97 2275 openvpn_2.6.14-1+deb13u3.dsc
47bb325d2c7307aa45fea3d644ccd06b98104fda 75792 openvpn_2.6.14-1+deb13u3.debian.tar.xz
d7ca374be64a1d67646df8298c9004d212607a84 7482 openvpn_2.6.14-1+deb13u3_amd64.buildinfo
Checksums-Sha256:
f444abce116aebaedf421f74f4948680669b1f20624783d02499f1d0b8d55712 2275 openvpn_2.6.14-1+deb13u3.dsc
7ecf77655c6e21033ac21110146d6fc1797dfc55ce428d0f054cde9ea04fc0cd 75792 openvpn_2.6.14-1+deb13u3.debian.tar.xz
9056fca45143f677e5be85521d575577df7839b8a08ad705fae2a6365bb353f5 7482 openvpn_2.6.14-1+deb13u3_amd64.buildinfo
Files:
adee06b30563b7698e3b1badc77905e0 2275 net optional openvpn_2.6.14-1+deb13u3.dsc
d83502b4d078ec81c0cb18e7a8b52e9f 75792 net optional openvpn_2.6.14-1+deb13u3.debian.tar.xz
e9413f7172b47342585193b5f8a4280b 7482 net optional openvpn_2.6.14-1+deb13u3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCgAvFiEE1uAexRal3873GVbTd1B55bhQvJMFAmpGiI0RHGJlcm5pQGRl
Ymlhbi5vcmcACgkQd1B55bhQvJNEpBAAkfMhn2y3ABy7MMYJw6D+fCT7XdoUAjFZ
ovWxT9tCud9Y5NpKO+MlFEbTBvtMvsluJxX2XssDkoc5VYMiL1r/pjtGYbKrhT4I
j5kek9+/9ePNy4blBtNn4IuWU2ZwN96Q6wemxN+cYLJVQKCEXmg8SPqz0pLZsxry
FVET+wBIL4f5fl3racHabELH2977IaX94G0/+sJwU4omt60PqrvjvdaeegVO20+Z
KwDEjY9e67LVViYSuhpPLhSLzEKaHi0x5/ysLdvDR+9iw04w5JrRe+Bt3bxaGknH
Jac1itXuPXe/9SfGD7xpH3z2akt7p14e1ZW54DMuf3kpPnDPUn09ICrowlW5wFye
5LN41HL5M970Uw5Y2TmGkSbQbTwHjUMD8VOT6Ghah02zklnNmd+IinZlqn9m97Sh
3oG6bi1nmw1vhGNiRSsqdD8FMuly1hgi+1UkhHXmkh0/KChIHxWQCAVQJDJa/p5R
wzfL1qGRH5iLbCHmgjEaHqBSURw4vanzmdqMp2w9msGWZe4QNSiL0fYGpkWd2Ou/
a2omDiFoNE79ROyyiz2HaDfRSZt+f6VwXx8GTd/IV3EMq/TZx8pq/I9/MhA4gcA9
HTfhB2wSL/3vrCVgjESAIoz5g4LHGSyBqTgAJJWqU6DOs0xFVv4GJO56Wb4LfGRY
q+ZkqcQC7Y0=
=/cOb
-----END PGP SIGNATURE-----
