diff --git a/meta-networking/recipes-support/openvpn/openvpn/0001-tests-skip-test-execution-when-cross-compiling.patch b/meta-networking/recipes-support/openvpn/openvpn/0001-tests-skip-test-execution-when-cross-compiling.patch deleted file mode 100644 index f8f2d2907f..0000000000 --- a/meta-networking/recipes-support/openvpn/openvpn/0001-tests-skip-test-execution-when-cross-compiling.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 93f7f6ca0c916427d28610d3e263fa556587532d Mon Sep 17 00:00:00 2001 -From: Haixiao Yan -Date: Thu, 26 Mar 2026 13:43:50 +0800 -Subject: [PATCH] tests: skip test execution when cross-compiling - -The auth-pam unit test Makefile.am unconditionally assigns the TESTS variable, -causing test execution to fail during cross-compilation because the target -binaries are not executable on the build host. - -Upstream-Status: Pending - -Signed-off-by: Haixiao Yan ---- - tests/unit_tests/plugins/auth-pam/Makefile.am | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/tests/unit_tests/plugins/auth-pam/Makefile.am b/tests/unit_tests/plugins/auth-pam/Makefile.am -index ba32013ac920..7da299ccde92 100644 ---- a/tests/unit_tests/plugins/auth-pam/Makefile.am -+++ b/tests/unit_tests/plugins/auth-pam/Makefile.am -@@ -4,8 +4,10 @@ AM_TESTSUITE_SUMMARY_HEADER = ' for $(PACKAGE_STRING) auth_pam Plugin Unit-Tests - - if ENABLE_PLUGIN_AUTH_PAM - check_PROGRAMS = auth_pam_testdriver -+if !CROSS_COMPILING - TESTS = $(check_PROGRAMS) - endif -+endif - - auth_pam_testdriver_SOURCES = test_search_and_replace.c $(top_srcdir)/src/plugins/auth-pam/utils.h $(top_srcdir)/src/plugins/auth-pam/utils.c - auth_pam_testdriver_CFLAGS = @TEST_CFLAGS@ -I$(top_srcdir)/src/plugins/auth-pam --- -2.43.0 - diff --git a/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-13117.patch b/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-13117.patch deleted file mode 100644 index ea2e32bdcb..0000000000 --- a/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-13117.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 3ce0242e68527fd1e8d378aecb57c466e8058b44 Mon Sep 17 00:00:00 2001 -From: Max Fillinger -Date: Fri, 22 May 2026 14:34:57 +0200 -Subject: [PATCH] Fix tls_wrap_reneg use after free - -When dynamic tls-crypt is active, it is possible for tls_multi_process -to set to_link to session->tls_wrap_reneg.work and later free that -session, leaving to_link.data pointing to freed memory. - -This is not caught by the function check_session_buf_not_used because it -checks only tls_wrap, not tls_wrap_reneg. This commit adds that check. - -CVE: 2026-13117 -Github: OpenVPN/openvpn-private-issues#119 -Github: OpenVPN/openvpn-private-issues#125 -Reported-By: Trace37 Labs (https://github.com/trace37labs) -Github: OpenVPN/openvpn-private-issues#131 -Reported-By: Haiyang Huang -Signed-off-by: Max Fillinger -Acked-By: Arne Schwabe -(cherry picked from commit 2745768d6181c1d54ebfc5ef81f924a127f4f015) - -CVE: CVE-2026-13117 -Upstream-Status: Backport [https://github.com/OpenVPN/openvpn/commit/3ce0242e68527fd1e8d378aecb57c466e8058b44] -Signed-off-by: Omkar Patil ---- - src/openvpn/ssl.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c -index c0ab6d3dfbe..d7e93bd41ab 100644 ---- a/src/openvpn/ssl.c -+++ b/src/openvpn/ssl.c -@@ -3154,6 +3154,12 @@ check_session_buf_not_used(struct buffer *to_link, struct tls_session *session) - "still in use (tls_wrap.work.data)"); - goto used; - } -+ if (session->tls_wrap_reneg.work.data == dataptr) -+ { -+ msg(M_INFO, "Warning buffer of freed TLS session is " -+ "still in use (tls_wrap_reneg.work.data)"); -+ goto used; -+ } - - for (int i = 0; i < KS_SIZE; i++) - { diff --git a/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-40215.patch b/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-40215.patch deleted file mode 100644 index e1bd0c99df..0000000000 --- a/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-40215.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 4a2c827c2536aa03a1d6c7cc916689a46c067187 Mon Sep 17 00:00:00 2001 -From: Arne Schwabe -Date: Fri, 10 Apr 2026 16:59:53 +0200 -Subject: [PATCH] Ensure that buffer of freed session are not used - -In a race condition an old TLS session could still try to send a packet but -also get replaced by a new session. In this case, the buffer of the new -session is still referenced. Add the check_session_buf_not_used function -to mitigate this problem. - -Also make the check if the to_link pointer is in one of the memory -regions a bit better even though this not make a difference with the -way we use these structs. But better safe than sorry. - -A better solution to remove the TM_INITIAL state and handle reconnecting -session in their own complete tls_multi is a more involved fix that requires -a lot more refactoring. - -CVE: 2026-40215 -Reported-By: XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com) -Reported-By: Guannan Wang (wgnbuaa@gmail.com -Reported-By: Zhanpeng Liu (pkugenuine@gmail.com) -Reported-By: Guancheng Li (lgcpku@gmail.com) -Signed-off-by: Arne Schwabe - -Change-Id: I7c5fa2a7a2563b7a8955d386411f3ceffe5b092f -Private-URL: https://github.com/OpenVPN/openvpn-private-issues/issues/112 -Acked-by: Gert Doering - -CVE: CVE-2026-40215 -Upstream-Status: Backport [https://github.com/OpenVPN/openvpn/commit/4a2c827c2536aa03a1d6c7cc916689a46c067187] - -Signed-off-by: Gert Doering -(cherry picked from commit b2a15fb84d85790eeae4a2e12b431cbfd0b0302f) -Signed-off-by: Omkar Patil ---- - src/openvpn/ssl.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c -index b188b4e9b32..a63d142ec46 100644 ---- a/src/openvpn/ssl.c -+++ b/src/openvpn/ssl.c -@@ -3280,6 +3280,7 @@ tls_multi_process(struct tls_multi *multi, struct buffer *to_link, - if (i == TM_ACTIVE && ks_lame->state >= S_GENERATED_KEYS - && !multi->opt.single_session) - { -+ check_session_buf_not_used(to_link, session); - move_session(multi, TM_LAME_DUCK, TM_ACTIVE, true); - } - else -@@ -3353,6 +3354,7 @@ tls_multi_process(struct tls_multi *multi, struct buffer *to_link, - */ - if (TLS_AUTHENTICATED(multi, &multi->session[TM_INITIAL].key[KS_PRIMARY])) - { -+ check_session_buf_not_used(to_link, &multi->session[TM_ACTIVE]); - move_session(multi, TM_ACTIVE, TM_INITIAL, true); - tas = tls_authentication_status(multi); - msg(D_TLS_DEBUG_LOW, diff --git a/meta-networking/recipes-support/openvpn/openvpn_2.7.0.bb b/meta-networking/recipes-support/openvpn/openvpn_2.7.5.bb similarity index 95% rename from meta-networking/recipes-support/openvpn/openvpn_2.7.0.bb rename to meta-networking/recipes-support/openvpn/openvpn_2.7.5.bb index 5cf7735eea..0aea6b7e74 100644 --- a/meta-networking/recipes-support/openvpn/openvpn_2.7.0.bb +++ b/meta-networking/recipes-support/openvpn/openvpn_2.7.5.bb @@ -9,16 +9,13 @@ inherit autotools systemd update-rc.d pkgconfig ptest SRC_URI = "http://swupdate.openvpn.org/community/releases/${BP}.tar.gz \ file://0001-configure.ac-eliminate-build-path-from-openvpn-versi.patch \ - file://0001-tests-skip-test-execution-when-cross-compiling.patch \ file://openvpn \ file://run-ptest \ - file://CVE-2026-40215.patch \ - file://CVE-2026-13117.patch \ " UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads" -SRC_URI[sha256sum] = "2f0e10eb272be61e8fb25fe1cfa20875ff30ac857ef1418000c02290bd6dfa45" +SRC_URI[sha256sum] = "c6864b3c7d4e059c7d6ce22d1b5fa646c8b379a06af872eeb9792b6083a44ac4" CVE_STATUS[CVE-2020-27569] = "not-applicable-config: Applies only Aviatrix OpenVPN client, not openvpn"