Hi, @LTS-coordinator: Please be aware.
Am Freitag, dem 03.07.2026 um 14:16 +0200 schrieb Bernhard Schmidt: > Hi Youri, > > > > Upgrading openvpn from 2.5.1-3 to 2.5.1-3+deb11u3 lead to segfault crashes. > > I'm seeing TLS timeouts too in the logs but I'm unsure if those are > > correlated. > > > > [Thu Jul 2 23:12:05 2026] openvpn[2387385]: segfault at 0 ip > > 000055f1ee7aec87 sp 00007ffc69242b50 error 4 in openvpn[55f1ee73d000+86000] > > [Thu Jul 2 23:12:05 2026] Code: f2 8b 05 3c 55 05 00 45 31 ed 85 c0 75 > > 53 c7 43 08 00 00 00 00 48 c7 43 10 00 00 00 00 5b 41 5c 41 5d c3 48 8b > > 8e 18 05 00 00 <8b> 11 85 d2 7e ed 48 8b 49 70 45 31 e4 eb 13 66 2e 0f > > 1f 84 00 00 > > > > Symbols are stripped in the binary so I could not get more information. > > > > Rolling back the openvpn version fixed the issue. > > > > I understand this version of Debian is not supported anymore, and this > > will likely get no fix. > > But I thought about reporting it to document it for others. > > It is suppported by the Debian LTS team. The last upload of > 2.5.1-3+deb11u3 was done by Daniel Leidert, copying him. Thanks. I am being told that the same issue has been reported to the LTS team from other sources. I've already looked into it and spotted the possible cause. The issue has likely been caused by one of the patches to address CVE-2026-40215 which introduces check_session_buf_not_used(). I'm in the process of checking that further. @Bernhard: Trixie is not affected. It contains the necessary changes in this function. On a sidenote: The fix introduces CVE-2026-12996 and CVE-2026-13117, which were just published and addressed by upstream a few days ago (and here, Trixie is affected). > One immediate question, you said downgrading to -3 fixed it. However, > there were several versions in between, a -3+deb11u1 in March 2025 and a > -3+deb11u2 in August 2025. It would be good to know if this problem was > introduced in +deb11u3 just now. > > Could you test downgrading to deb11u2? Yes, it would very much help to narrow it down and confirm it. Also, please provide all information that you have. Regards, Daniel
signature.asc
Description: This is a digitally signed message part
