ubuntu/+source/openvpn:applied/ubuntu/trusty-security

Last commit made on 2017-06-22
Get this branch:
git clone -b applied/ubuntu/trusty-security https://git.launchpad.net/ubuntu/+source/openvpn
Members of Ubuntu Server Dev import team can upload to this branch. Log in for directions.

Branch merges

Branch information

Name:
applied/ubuntu/trusty-security
Repository:
lp:ubuntu/+source/openvpn

Recent commits

d286091... by Marc Deslauriers on 2017-06-22

Import patches-applied version 2.3.2-7ubuntu3.2 to applied/ubuntu/trusty-security

Imported using git-ubuntu import.

Changelog parent: 368d06b7e8d50f0f3d810eeb262a97d973ae6519
Unapplied parent: b352ab2d52ffb00716d6bdb4c383b2d4cb1a33b6

New changelog entries:
  * SECURITY UPDATE: birthday attack when using 64-bit block cipher
    - debian/patches/CVE-2016-6329.patch: print warning if 64-bit cipher is
      selected in src/openvpn/crypto.c, src/openvpn/crypto_openssl.c.
    - CVE-2016-6329
  * SECURITY UPDATE: DoS due to Exhaustion of Packet-ID counter
    - debian/patches/CVE-2017-7479-pre.patch: merge
      packet_id_alloc_outgoing() into packet_id_write() in
      src/openvpn/crypto.c, src/openvpn/packet_id.c,
      src/openvpn/packet_id.h.
    - debian/patches/CVE-2017-7479.patch: drop packets instead of assert
      out if packet id rolls over in src/openvpn/crypto.c,
      src/openvpn/packet_id.c, src/openvpn/packet_id.h.
    - CVE-2017-7479
  * SECURITY UPDATE: Remotely-triggerable ASSERT() on malformed IPv6 packet
    - debian/patches/CVE-2017-7508.patch: remove assert in
      src/openvpn/mss.c.
    - CVE-2017-7508
  * SECURITY UPDATE: Remote-triggerable memory leaks
    - debian/patches/CVE-2017-7512.patch: fix leaks in
      src/openvpn/ssl_verify_openssl.c.
    - CVE-2017-7512
  * SECURITY UPDATE: Pre-authentication remote crash/information disclosure
    for clients
    - debian/patches/CVE-2017-7520.patch: prevent two kinds of stack buffer
      OOB reads and a crash for invalid input data in src/openvpn/ntlm.c.
    - CVE-2017-7520
  * SECURITY UPDATE: Potential double-free in --x509-alt-username and
    memory leaks
    - debian/patches/CVE-2017-7521.patch: fix double-free in
      src/openvpn/ssl_verify_openssl.c.
    - CVE-2017-7521
  * SECURITY UPDATE: DoS in establish_http_proxy_passthru()
    - debian/patches/establish_http_proxy_passthru_dos.patch: fix
      null-pointer dereference in src/openvpn/proxy.c.
    - No CVE number

b352ab2... by Marc Deslauriers on 2017-06-22

[PATCH] Fix a null-pointer dereference in

Gbp-Pq: establish_http_proxy_passthru_dos.patch.

aecc543... by Marc Deslauriers on 2017-06-22

[PATCH] Fix potential double-free in --x509-alt-username

Gbp-Pq: CVE-2017-7521.patch.

7ae0760... by Marc Deslauriers on 2017-06-22

[PATCH] Prevent two kinds of stack buffer OOB reads and a crash for

Gbp-Pq: CVE-2017-7520.patch.

f102394... by Marc Deslauriers on 2017-06-22

[PATCH] Fix remote-triggerable memory leaks (CVE-2017-7521)

Gbp-Pq: CVE-2017-7512.patch.

f2b7dfc... by Marc Deslauriers on 2017-06-22

[PATCH] Fix remotely-triggerable ASSERT() on malformed IPv6 packet.

Gbp-Pq: CVE-2017-7508.patch.

788eacd... by Marc Deslauriers on 2017-06-22

[PATCH] Drop packets instead of assert out if packet id rolls over

Gbp-Pq: CVE-2017-7479.patch.

5bf0d54... by Marc Deslauriers on 2017-06-22

[PATCH] cleanup: merge packet_id_alloc_outgoing() into

Gbp-Pq: CVE-2017-7479-pre.patch.

fa3ab2e... by Marc Deslauriers on 2017-06-22

[PATCH] Discourage using 64-bit block ciphers

Gbp-Pq: CVE-2016-6329.patch.

04c584b... by Marc Deslauriers on 2017-06-22

update test certs to fix FTBFS

Gbp-Pq: update_certs.patch.