v2.6.9

版本发布时间: 2024-02-14 21:43:18

OpenVPN/openvpn最新发布版本:v2.5.11(2024-07-18 22:59:38)

Security fixes:

Windows Installer: fix CVE-2023-7235 where installing to a non-default directory could lead to a local privilege escalation. Reported by Will Dormann.

Add support for building with mbedTLS 3.x.x
New option --force-tls-key-material-export to only accept clients that can do TLS keying material export to generate session keys (mostly an internal option to better deal with TLS 1.0 PRF failures).
Windows: bump vcpkg-ports/pkcs11-helper to 1.30
Log incoming SSL alerts in easier to understand form and move logging from --verb 8 to --verb 3.
protocol_dump(): add support for printing --tls-crypt packets

License change is now complete, and all code has been re-licensed under the new license (still GPLv2, but with new linking exception for Apache2 licensed code). See COPYING for details.

Code that could not be re-licensed has been removed or rewritten.
The original code for the --tls-export-cert feature has been removed (due to the re-licensing effort) and rewritten without looking at the original code. Feature-compatibility has been tested by other developers, looking at both old and new code and documentation, so there should not be a user-visible change here.
IPv6 route addition/deletion are now logged on the same level (3) as for IPv4. Previously IPv6 was always logged at --verb 1.
Better handling of TLS 1.0 PRF failures in the underlying SSL library (e.g. on some FIPS builds) - this is now reported on startup, and clients before 2.6.0 that can not use TLS EKM to generate key material are rejected by the server. Also, error messages are improved to see what exactly failed.

FreeBSD: for servers with multiple clients, reporting of peer traffic statistics would fail due to insufficient buffer space (#487)

Windows Client: Community MSI installer for Windows client can be found at Community Downloads.

Linux Packages: Instructions for installing community-maintained Linux packages can be found in the Community Wiki.

Full Changelog: https://github.com/OpenVPN/openvpn/compare/v2.6.8...v2.6.9