Re: [Openvpn-devel] IRC community meeting summary

Thanks, Gert.

On Fri, Aug 7, 2026 at 3:13 AM Gert Doering <[email protected]> wrote:
>
> Hi,
>
> On Thu, Aug 06, 2026 at 03:29:40PM -0400, Jonathan K. Bullard wrote:
> > On Wed, Aug 5, 2026 at 10:57???AM Johan Draaisma via Openvpn-devel
> > <[email protected]> wrote:
> > >
> > >  There are also some security fixes backported to 2.5 but that branch does not have official releases anymore (out of support).
> >
> > Are the devs planning to backport any more of the recent security
> > fixes to the 2.5 branch? There's only one commit [1] on GitHub since
> > July 1, and it doesn't affect "openvpn" code, only "openvpnserv" code,
> > so it's not relevant to Tunnelblick. (There are no changes to
> > Changes.rst, either.)
>
> I forgot Changes.rst ("because for the other branches we only update this
> on an actual release").
>
> The other CVE fixed in this release ("Make --x509-username-field work with
> Mbed TLS") was a consequence of a 2.7 change, and does not affect 2.5 or 2.6.
>

Ah, now I get it! Thanks.


> The CVEs in 2.7.5 (July 1st) that are also relevant to 2.5/2.6 code should
> all be backported.
>
>
> > If there are more backports planned, does anyone have an idea of when
> > they might be available?
> >
> > (I'm not asking for more or faster backports, but I would like to know
> > if any are planned and if so, when they might happen. And I understand
> > that plans can change!)
>
> Are you missing something specifically?  I might have lost track of
> which branch is affected by what.
>

No, I haven't looked into it in more detail; I'm trusting the OpenVPN devs.


> That said, 2.5 is in "dead software maintenance mode" - we attempt to
> backport security / crash bugs, on a best effort basis.  There will not
> be new 2.5.x releases, and we very much encourage users to migrate to
> a current release.
>
>   https://community.openvpn.net/Pages/Supported%20versions
>
> (looking at this, I see it's officially "unsupported" already - I thought
> 2.5 was still in "git tree only", but even that ran out already)

Understood. Thanks again for all your help.


_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel