From nobody Wed Apr 02 19:33:24 2025 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZSZm44M0pz5rV7f; Wed, 02 Apr 2025 19:33:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4ZSZm43jtsz3MTy; Wed, 02 Apr 2025 19:33:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1743622404; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/4naleECGFdmM1yNppdrn2aD8t+f9pqIV6SO+xvtm4E=; b=HVWXrdXyeK6flSpLum5drfVToOXidykRVDrvHHgKSiaP7HpuGLLLgPNv7cY5wZLUynL189 eZnGpn2tmELaz02QzZg7ywSabgSJ2IrVRKHebQTqbylEYRJeDKoELpkCRrAXqjpA3o0Z7L 9uCab8qwbpDGWeuvzBN4P4Zk9DNnWTiCLKkrXgcffqDN5yPQaKEtwnk6BBvPmRmYNQro8u OdrAHdlW4uCSBsol4TmkptLUWcyGx63TPxTQSNYv+u976wFxpWbTcuYhtSnjQgehxYnNPQ mkdlv4aBoaIKpVN0FIH2hVVOBD9jvJqxV5ciWTktRcpzTOA8ps0GOMnw0mJLrA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1743622404; a=rsa-sha256; cv=none; b=gpUDaPkq/+uFbEA1CCzrfIbNcmAxmTGEseW2j5srtn2ajJviAQ9/ZFPXP6ygkG58rXDTGi /yI2pjK0Rh05TOOAUuio+HBDEDYX2rPIBcnxfeBORlR9G/IP/Y+0p56v6sDcr9T9kOTrq2 Jc9/eyFWZuieNOJCEvQzEhm9eRvgQddfDRm6QhqDO//V8qGRpd1oQAY07dPQUhxhba90MC 7rNVqEU5tWRMKlIS8jKixrZBtJtE5hOJf/+MXG363Q9Gx9mBW0P1jGmaPcPRuJ3LTWBfsw GMFAkx4BPywaM8WlPWNrPzbMLqpT2zvjk8skANI16kCwS7DpNgtiDlGnyW6cxg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1743622404; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/4naleECGFdmM1yNppdrn2aD8t+f9pqIV6SO+xvtm4E=; b=cNyODrpVcB4oV5bv9BwMNyx+pQ9/hZCsZP/dgVXPAhdToS8pyQeD/kEiXa8eiRWaeyZV1D 4c9B1va8Djc+uX8sWOxJDfMJeR9F5sTmc/mOzPxfe4nOy0fTa0Tz5uLTadpueAWv1MtH7B X1czl+gHFQgN9VAkpxq7tJUA7QMyHR43HHoWhbgDmeK1OswGbJ/DPhFUi8KvIwTR0B4Q1B NsoggzSFig1JvyElleJyTSQPE4icoLnHjxs/BiDZ/iLtLjwJozKIZKRMxlD+zItY7I++9Z 9S0uytklccGSSTwvJp3jMZa8TJq3TKhybr83ZFhOG5Ox5zLwpyChzjBybDm4jA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4ZSZm43BMKzTk5; Wed, 02 Apr 2025 19:33:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 532JXO6l047256; Wed, 2 Apr 2025 19:33:24 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 532JXOOb047253; Wed, 2 Apr 2025 19:33:24 GMT (envelope-from git) Date: Wed, 2 Apr 2025 19:33:24 GMT Message-Id: <202504021933.532JXOOb047253@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Matthias Andree Subject: git: e1b5c9787523 - main - security/vuxml: add openvpn<2.6.14 server DoS vuln List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-all@freebsd.org Sender: owner-dev-commits-ports-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: mandree X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: e1b5c9787523a3f99fdaaabf16caef1a4049dbad Auto-Submitted: auto-generated The branch main has been updated by mandree: URL: https://cgit.FreeBSD.org/ports/commit/?id=e1b5c9787523a3f99fdaaabf16caef1a4049dbad commit e1b5c9787523a3f99fdaaabf16caef1a4049dbad Author: Matthias Andree AuthorDate: 2025-04-02 19:22:24 +0000 Commit: Matthias Andree CommitDate: 2025-04-02 19:22:24 +0000 security/vuxml: add openvpn<2.6.14 server DoS vuln Security: 2cad4541-0f5b-11f0-89f8-411aefea0df9 Security: CVE-2025-2704 --- security/vuxml/vuln/2025.xml | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml index 56e73f865ee6..a746776c70c7 100644 --- a/security/vuxml/vuln/2025.xml +++ b/security/vuxml/vuln/2025.xml @@ -1,3 +1,40 @@ + + openvpn -- server-side denial-of-service vulnerability with tls-crypt-v2 + + + openvpn + 2.6.12.6.14 + + + openvpn-devel + g20250402,1 + + + + +

Gert Doering reports:

+
+

OpenVPN servers between 2.6.1 and 2.6.13 using + --tls-crypt-v2 can be made to abort with an ASSERT() message by + sending a particular combination of authenticated and malformed packets.

+

To trigger the bug, a valid tls-crypt-v2 client key is needed, or + network observation of a handshake with a valid tls-crypt-v2 client key

+

No crypto integrity is violated, no data is leaked, and no remote + code execution is possible.

+

This bug does not affect OpenVPN clients.

+
+ + + + CVE-2025-2704 + https://github.com/OpenVPN/openvpn/blob/v2.6.14/Changes.rst#overview-of-changes-in-2614 + + + 2025-03-26 + 2025-04-02 + + + gitea -- Multiple vulnerabilities