Hi, On Thu, Aug 06, 2026 at 03:29:40PM -0400, Jonathan K. Bullard wrote: > On Wed, Aug 5, 2026 at 10:57???AM Johan Draaisma via Openvpn-devel > <[email protected]> wrote: > > > > There are also some security fixes backported to 2.5 but that branch does > > not have official releases anymore (out of support). > > Are the devs planning to backport any more of the recent security > fixes to the 2.5 branch? There's only one commit [1] on GitHub since > July 1, and it doesn't affect "openvpn" code, only "openvpnserv" code, > so it's not relevant to Tunnelblick. (There are no changes to > Changes.rst, either.)
I forgot Changes.rst ("because for the other branches we only update this
on an actual release").
The other CVE fixed in this release ("Make --x509-username-field work with
Mbed TLS") was a consequence of a 2.7 change, and does not affect 2.5 or 2.6.
The CVEs in 2.7.5 (July 1st) that are also relevant to 2.5/2.6 code should
all be backported.
> If there are more backports planned, does anyone have an idea of when
> they might be available?
>
> (I'm not asking for more or faster backports, but I would like to know
> if any are planned and if so, when they might happen. And I understand
> that plans can change!)
Are you missing something specifically? I might have lost track of
which branch is affected by what.
That said, 2.5 is in "dead software maintenance mode" - we attempt to
backport security / crash bugs, on a best effort basis. There will not
be new 2.5.x releases, and we very much encourage users to migrate to
a current release.
https://community.openvpn.net/Pages/Supported%20versions
(looking at this, I see it's officially "unsupported" already - I thought
2.5 was still in "git tree only", but even that ran out already)
gert
--
"If was one thing all people took for granted, was conviction that if you
feed honest figures into a computer, honest figures come out. Never doubted
it myself till I met a computer with a sense of humor."
Robert A. Heinlein, The Moon is a Harsh Mistress
Gert Doering - Munich, Germany [email protected]
signature.asc
Description: PGP signature
_______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
