openvpn: bump to 2.7.8
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	ordex
	Mon, Oct 26, 8:35 PM

Description

OpenVPN 2.7.8 fixes CVE-2026-84790 (certificates with NULL bytes in the subject are now rejected) and CVE-2026-88964 (unsigned underflow in options), plus Linux DCO races around iroute cleanup and netlink notifications.

Debian has packaged it as debian/2.7.8-1
Bump scripts/package-build/openvpn/package.toml from debian/2.7.7-1.

The carried DCO patch (gerrit 1734) is still needed.

Details

Version: -
Is it a breaking change?: Perfectly compatible
Issue type: Security vulnerability

Event Timeline

ordex created this task.Mon, Oct 26, 8:35 PM

ordex triaged this task as Normal priority.

ordex created this object in space S1 VyOS Public.

pasik subscribed.Mon, Oct 26, 8:48 PM

PR: https://github.com/vyos/vyos-build/pull/1335

Viacheslav raised the priority of this task from Normal to High.Tue, Oct 27, 1:13 PM

Viacheslav closed this task as Resolved.Thu, Oct 29, 5:55 PM

Viacheslav moved this task from Need Triage to Completed on the VyOS Rolling board.

openvpn: bump to 2.7.8Closed, ResolvedPublicActions

Description

Details

Event Timeline

openvpn: bump to 2.7.8
Closed, ResolvedPublic
Actions