OpenVPN[-mbedtls] security update to 2.4.4
Upstream maintainers write: "This release includes a large number of small
fixes and enhancements. There is also an important security fix for legacy
setups that may still be using key-method 1. As that option was deprecated
12 years ago we estimate that not many production setups are affected in
practice."
Security information:
https://community.openvpn.net/openvpn/wiki/CVE-2017-12166
Change Summary:
https://github.com/OpenVPN/openvpn/blob/release/2.4/Changes.rst#version-244
Changes as Git shortlog:
https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24#OpenVPN2.4.4
Given the low impact, let's forget about MFHing this three days before
2017Q3 becomes EOL and relieved by 2017Q4.
Reported by: portscout
Security: CVE-2017-12166
Security: 3dd6ccf4-a3c6-11e7-a52e-0800279f2ff8