The OpenVPN community project team is proud to release OpenVPN 2.7.9. This is a
bugfix release fixing several security issues.
Security fixes:
* win32: restrict loading plugin dependencies (DLLs) to plugin, app and system
directories.
* win32: run openvpn.exe from the interactive service at "high integrity
level",
that is, process memory of openvpn.exe and all its threads are protected from
tampering. Signals/Events are still permitted.
* win32: openvpnserv: strictly filter user-defined environment variables before
passing to openvpn.exe (CVE-2026-121720)
(Issue found by @refiaa)
* win32: openvpnserv: make validation of openvpn command line more robust to
invalid-quoting attacks (CVE-2026-115342)
* win32: openvpn.exe: change parsing of commandline to use the same function
that
the interactive service uses (CommandLineToArgvW()) (CVE-2026-115342)
(Issues found by Heiko Hund)
Bug fixes:
* Username/Password parsing from --auth-user-pass file (or inline) left parts
of
overlong usernames in the password field. Fix. (GH OpenVPN/openvpn#1140)
* win32: openvpnserv: fix memory leak for security descriptors
* win32: repair logging of errors in Windows tun_read_queue()
* win32: avoid accessing uninitialized structure data if GetInterfaceInfo() or
GetPerAdapterInfo() fail
* win32: openvpnserv: avoid double free() if GetTokenInformation() fails
* win32: openvpnserv: avoid potential format-string issue on registry defaults
* win32: openvpnserv: repair error reporting on RegGetValueA() failures inside
GetItfDnsServersV4()
* win32: openvpnserv: fix inet_ntop() return code check in
GetItfDnsServersV6(),
making it ignore DHCP-provided DNS servers.
* route: repair printing of ROUTE_GATEWAY/ROUTE6_GATEWAY info - the actual
gateway
handling was correct, just not printing anything anymore.
* config: check_file_access: fix --extra-certs access check
* win32: tun: free gc arena in windows_set_mtu() (mem leak in error path)
* route: close socket in Haiku get_default_gateway() (FD leak)
* win32: openvpnserv: skip conversion of empty domain names
* win32: cmake+mingw: don't prefix the event message DLL with lib (it was
building
'libopenvpnservmsg.dll' instead of 'openvpnservmsg.dll')
* win32: pass the buffer size in bytes to get_openvpn_reg_value()
* PUSH_UPDATE server: free temporary options after sending message (memleak)
User-visible Changes:
* Linux: set IFF_BACKPRESSURE on Linux (if available)
This helps the kernel tun/tap to apply proper prioritization (qdisc etc) to
incoming packets if userspace is slow to process them. Without the flag, the
kernel would just drop everything.
* Management/GUI: Optionally indicate username in >PASSWORD '<UP_TYPE>' prompts
If an openvpn config has a username set but no password, and OpenVPN wants to
prompt for the password, the GUI could not see the username today and
prompted for
both. With this change, OpenVPN sends a hint to the management interface, so
a GUI
can pre-fill the username field, or only prompt for the password.
This is only done if the management interface client announces support for it
(compatibility level >= 6).
Code improvements/general hardening:
* crypto_epoch: wipe key material with secure_memzero()
* do not look up "none" cipher in OpenSSL - this avoids leaving an "error" on
the
OpenSSL error stack, which can then later lead to spurious SSL error prints
on CRL
loading.
* Make CRL reload EOF detection independent of stale error queue entries (GH:
OpenVPN/openvpn#1104)
* tls_crypt: fix handling of "cipher final output" (which is always empty on
today's
SSL libraries, so no impact today, but might not be in future)
* crypto: ASSERT() opt before first use in openvpn_decrypt_aead()
* auth_token: wipe the server secret key after loading it
* port-share: do not write journal file through symlinks or hardlinks (and also
document how port-share directory should be set up) (GH OpenVPN/openvpn#1124)
* dns-updown: close first pipe if creating the second one fails (avoid leaking
file
descriptors on error)
* init: check parameters for NULL before strlen() in send_cc_message (not
triggerable today)
* crypto_openssl: Clear PEM decoded key data before freeing it
* Increase the buffer size for alert-message in management user-pass query (so
long
usernames can be hinted towards the GUI)
* win32: openvpnserv: validate message size for dns/nrpt/wins handlers (GH:
OpenVPN/openvpn#1129)
* win32: plugin: detect too long plugin paths on Windows
* win32: openvpnserv: null-terminate iface.name in address and route handlers
(GH: OpenVPN/openvpn#1130)
Documentation improvements:
* Fix numbering of examples in management-notes.txt
* Document "notify" as auth pending method
* Convert Changes.rst to Markdown (2.7)
Long-term code maintenance:
* OpenSSL 4.1 compatibility: use ASN1_STRING_get_length() now, providing a
fallback
to ASN1_STRING_length() for older SSL libraries.
* Linux: sitnl: use RTM_SETLINK for updating existing interfaces (instead of
RTM_NEWLINK)
* gen-sample-keys.sh: Don't apply server extensions to CSRs
* review all usages of strncpy() (change to strncpynt(), memcpy(), etc. where
appropriate)
Windows MSI changes since 2.7.8-I001:
* Improve setting ACLs for non-"Program Files" installation directories.
There were some configurations where the intended ACLs were not applied.
(GH: OpenVPN/openvpn-build#1520)
(Issue found by @refiaa)
* Update included openvpn-gui to 11.67
* Support username indication in communication with OpenVPN (see above).
Prefills
the username in prompt to user. (GH: OpenVPN/openvpn-gui#719)
* Fix tray tooltip and popup positioning on non-primary monitors (GH:
OpenVPN/openvpn-gui#836)
* Improve Swedish translation (GH: OpenVPN/openvpn-gui#828)
More details can be found in the Changes document:
<https://github.com/OpenVPN/openvpn/blob/v2.7.9/Changes.md>
Source code and Windows installers can be downloaded from our download page:
<https://openvpn.net/community/>
Packages for Debian, Ubuntu, Fedora, RHEL, and openSUSE are available in the
various
official Community repositories:
<https://community.openvpn.net/Pages/OpenVPN%20software%20repos>
Kind regards,
--
Frank Lichtenheld
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
