-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 01 Jul 2026 22:20:55 +0200
Source: openvpn
Architecture: source
Version: 2.6.14-0+deb12u2
Distribution: bookworm-security
Urgency: high
Maintainer: Bernhard Schmidt <berni@debian.org>
Changed-By: Bernhard Schmidt <berni@debian.org>
Changes:
 openvpn (2.6.14-0+deb12u2) bookworm-security; urgency=high
 .
   * Cherry-pick upstream security patches from the 2.6.21 release
     - CVE-2026-12996: Fix use-after-free bug in ack_write_buf(), triggerable by
       a well-timed sequence of control channel + authentication packets
     - CVE-2026-13117: Fix use-after-free bug in tls_wrap_reneg(), triggerable
       by suitable sequence of dynamic tls-crypt control-channel packets
     - CVE-2026-13122: Fix server crash on reception of suitably malformed
       auth-token, if --auth-gen-token external-auth is active
     - CVE-2026-12932: Fix memory-leak in tls-crypt-v2 client key handling that
       could lead to out-of-memory situations and subsequent server crashes
     - CVE-2026-11771: Fix possible 1-byte buffer overrun on NTLMv2 proxy
       responses.
     - CVE-2026-13698: Fix another memory leak on reception of suitable
       tls-crypt-v2 packets that could lead to an out of memory situation and
       server crash
Checksums-Sha1:
 aafa96aaa2b6e21f4718607cc0bc58477f854d26 2271 openvpn_2.6.14-0+deb12u2.dsc
 f25e6b1fb59b2fa0eaeb82086f515440879a41c3 75136 openvpn_2.6.14-0+deb12u2.debian.tar.xz
 1ee1550e71d1c99153cde66dbaf8e2a7a1d59257 8313 openvpn_2.6.14-0+deb12u2_amd64.buildinfo
Checksums-Sha256:
 040bba014900f3ff5417c9e049a57b5d36a7e969d2f47933a9b1728e804c76a0 2271 openvpn_2.6.14-0+deb12u2.dsc
 8024bac4a098e54c9af32a4a818a1b8557954793973a618675e1cdd9fbcf387b 75136 openvpn_2.6.14-0+deb12u2.debian.tar.xz
 1dc3e35f92d53b8abd74053d378b377554a45d84ef3beb8a8a56e45fba3dc331 8313 openvpn_2.6.14-0+deb12u2_amd64.buildinfo
Files:
 ff531bbe9e92cee568e30a9c7772d25b 2271 net optional openvpn_2.6.14-0+deb12u2.dsc
 cbac62e4fd271540dd7da425c9bc1818 75136 net optional openvpn_2.6.14-0+deb12u2.debian.tar.xz
 ff9caf5552a73b19bd4f6a913ad7dda2 8313 net optional openvpn_2.6.14-0+deb12u2_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEE1uAexRal3873GVbTd1B55bhQvJMFAmpG4J4RHGJlcm5pQGRl
Ymlhbi5vcmcACgkQd1B55bhQvJN32A/+LX/JHTg2+hZnCL7NFikxf4tJyVaPsr2V
Eu3xuKH/8oBiOQdq6bWte4/1ZSIbP15l4okaVikbIrWn8C7lGgXyeNwmKfNKIvf+
+S1WsauvwBK2hgzQPh8Hby3J7kdBCT5GDvxsnWhJumrOVh5PIJ7WAIDRDlQ63AuU
K4909KU9AIPDiJfTqhHLkPrlNkikaDp/5Ri/eyDzsrPd656MgtwV4CnjP6wLxhMM
DsBqaFro8XnGpdXaPRMZrQsqcvsbldZCFcIJr0cGZ7Jt1WuFmwBUh15dZndifyMc
cCgXsuUC0PZIwZI8ZIunX6Hx1MnLsBR4jZEuoYgOYg92qdClaCDZCluKs4F4P4k+
8mbbpzZD15NIHJJVeKDfsBWBbBGIBH3Esn9AAxVmcDwvEHwukmawHo0Sb0OSZ3UL
2pPI54AiwoSapcB+6y+BF+rY5e7oyrgRq9uEChZwoRZBPLHo7Q5uWage3gYP1zNf
TX38ijwh1bJc3HFH0sEfiHvFDDMMF61OpWLgOpvq201VsBtahO41XQ1/HdiKW+qs
i/bpszWWaIiSkhE8NV/LSv9Oj7y3S5w4MIrmAgCIrJDZIXInbJoiZPWRPulyjgaD
hD0lFS3utRjKqL3Uxb6ijF5YJbh5nIHKGPoNjfZE1jcnmfaiyb0Gca7S5pHb5iso
CXLolk2blSk=
=o7mT
-----END PGP SIGNATURE-----