Re: [Openvpn-devel] IRC community meeting summary

Gert Doering <[email protected]> Fri, 7 Aug 2026 09:13:23 +0200
Newsgroups	net.sourceforge.lists.openvpn-devel
Message-ID	<[email protected]>
Hi,

On Thu, Aug 06, 2026 at 03:29:40PM -0400, Jonathan K. Bullard wrote:
> On Wed, Aug 5, 2026 at 10:57???AM Johan Draaisma via Openvpn-devel
> <[email protected]> wrote:
> >
> >  There are also some security fixes backported to 2.5 but that branch does not have official releases anymore (out of support).
> 
> Are the devs planning to backport any more of the recent security
> fixes to the 2.5 branch? There's only one commit [1] on GitHub since
> July 1, and it doesn't affect "openvpn" code, only "openvpnserv" code,
> so it's not relevant to Tunnelblick. (There are no changes to
> Changes.rst, either.)

I forgot Changes.rst ("because for the other branches we only update this
on an actual release").

The other CVE fixed in this release ("Make --x509-username-field work with
Mbed TLS") was a consequence of a 2.7 change, and does not affect 2.5 or 2.6.

The CVEs in 2.7.5 (July 1st) that are also relevant to 2.5/2.6 code should
all be backported.


> If there are more backports planned, does anyone have an idea of when
> they might be available?
> 
> (I'm not asking for more or faster backports, but I would like to know
> if any are planned and if so, when they might happen. And I understand
> that plans can change!)

Are you missing something specifically?  I might have lost track of
which branch is affected by what.

That said, 2.5 is in "dead software maintenance mode" - we attempt to
backport security / crash bugs, on a best effort basis.  There will not
be new 2.5.x releases, and we very much encourage users to migrate to
a current release.

  https://community.openvpn.net/Pages/Supported%20versions

(looking at this, I see it's officially "unsupported" already - I thought
2.5 was still in "git tree only", but even that ran out already)

gert
-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             [email protected]

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
signature.asc (application/pgp-signature, 699 B)