Thanks, Gert. On Fri, Aug 7, 2026 at 3:13 AM Gert Doering <[email protected]> wrote: > > Hi, > > On Thu, Aug 06, 2026 at 03:29:40PM -0400, Jonathan K. Bullard wrote: > > On Wed, Aug 5, 2026 at 10:57???AM Johan Draaisma via Openvpn-devel > > <[email protected]> wrote: > > > > > > There are also some security fixes backported to 2.5 but that branch > > > does not have official releases anymore (out of support). > > > > Are the devs planning to backport any more of the recent security > > fixes to the 2.5 branch? There's only one commit [1] on GitHub since > > July 1, and it doesn't affect "openvpn" code, only "openvpnserv" code, > > so it's not relevant to Tunnelblick. (There are no changes to > > Changes.rst, either.) > > I forgot Changes.rst ("because for the other branches we only update this > on an actual release"). > > The other CVE fixed in this release ("Make --x509-username-field work with > Mbed TLS") was a consequence of a 2.7 change, and does not affect 2.5 or 2.6. >
Ah, now I get it! Thanks. > The CVEs in 2.7.5 (July 1st) that are also relevant to 2.5/2.6 code should > all be backported. > > > > If there are more backports planned, does anyone have an idea of when > > they might be available? > > > > (I'm not asking for more or faster backports, but I would like to know > > if any are planned and if so, when they might happen. And I understand > > that plans can change!) > > Are you missing something specifically? I might have lost track of > which branch is affected by what. > No, I haven't looked into it in more detail; I'm trusting the OpenVPN devs. > That said, 2.5 is in "dead software maintenance mode" - we attempt to > backport security / crash bugs, on a best effort basis. There will not > be new 2.5.x releases, and we very much encourage users to migrate to > a current release. > > https://community.openvpn.net/Pages/Supported%20versions > > (looking at this, I see it's officially "unsupported" already - I thought > 2.5 was still in "git tree only", but even that ran out already) Understood. Thanks again for all your help. _______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
