HomeFreeBSD

security/openvpn-devel: upgrade port to git commit d6ee27b4ff (2.7_rc2, 2025-11…

Description

security/openvpn-devel: upgrade port to git commit d6ee27b4ff (2.7_rc2, 2025-11-17)

This commit brings the port to "openvpn 2.7_rc2"

Changes of interest for FreeBSD:

  • IPv6 address parsing: fix buffer overread on invalid input (CVE-2025-12106)
  • HMAC verification check: fix incorrect memcmp() call (CVE-2025-13086)
  • even more type conversion related warnings have been fixed
  • DCO FreeBSD improvements:

improving debug messages (verb 6)
implement client-side counter handling
repair --inactive (and document shortcomings)
repair handling of DCO disconnection notifications in --client mode

  • improve cmocka unit test assert() handling
  • PUSH_UPDATE server: fix reporting of client IPs in `status` output after pushing a new IPv4/IPv6 address to client
  • AEAD cipher safety margins: fix calculation of AEAD blocks in use (old code would undercount blocks)
  • fix invalid pointer creation / memory overread in tls_pre_decrypt
  • deprecate `--opt-verify` (change into no-op + warning)
  • additions by mandree@ --

Security: 50a0c266-c3ff-11f0-b513-0da7be77c170
Security: CVE-2025-12106
Security: 17a40d76-c3fd-11f0-b513-0da7be77c170
Security: CVE-2025-13086
MFH: 2025Q4

Details

Provenance
gert_greenie.muc.deAuthored on Nov 17 2025, 9:35 PM
mandreeCommitted on Nov 17 2025, 10:09 PM
Parents
R11:f0181a684513: security/openvpn: security update to 2.6.16
Branches
Unknown
Tags
Unknown