Debian alert DLA-4653-2 (openvpn)

From:
             
 
Daniel Leidert <dleidert@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4653-2] openvpn regression update
Date:
             
 
Mon, 06 Jul 2026 01:40:48 +0200
Message-ID:
             
 
<da564489dd5dc69bb87827cb1dd68fc553056dc4.camel@debian.org>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4653-2                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Daniel Leidert
July 06, 2026                                 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : openvpn
Version        : 2.5.1-3+deb11u4
CVE ID         : CVE-2026-12996
Debian Bug     : 1141326

A regression has been discovered in the latest release of openvpn
2.5.1-3+deb11u3. The fix adressing CVE-2026-40215 contained a bug which
could lead to segmentation faults. Furthermore, the function backported
for the fix has recently been disovered to be vulnerable to CVE-2026-
12996.

For Debian 11 bullseye, these problems have been fixed in version
2.5.1-3+deb11u4.

We recommend that you upgrade your openvpn packages.

For the detailed security status of openvpn please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/openvpn

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQJIBAABCgAyFiEEvu1N7VVEpMA+KD3HS80FZ8KW0F0FAmpK64AUHGRsZWlkZXJ0
QGRlYmlhbi5vcmcACgkQS80FZ8KW0F1rIA//dAK8VLpNiv0m+MaG4DAQLKcww24/
hbLFyJ1Dyd0PbEdzr2RV/YsDvh986e8Tv70oSrgW+YcHZIP/8rd0w2LGZCcuoU1j
u7Dw6NApj23hjbk6jiOufD4ofuSUAQryhrVJubx+BytU3k0ABfIJZgeOpGeSmd1S
rrW8I4Ho9ufwd3J7EckY/GiU56kHFLBxVAyghX8ZHAdTSqq7y2F+I+YcQYT1QRi6
YwY06OgX4INalwkM0QeUo3k9k/u9RCuvDxRikLUIWeDEBt3FBcM9kjWJwlxCkP5K
FBbZU/H2Q6MobE10npclNCZ02dxb+l/2nW/4V0sJz+V/nO8uUIyUK4h8GO4F3jmj
iDYzwoh/Vp8oOuGit07YtBXw6b59mTRKhgv4lFcviKxCrrCy/VhoJwGN7C/B+h5y
QJvC9921bmmcN2FtaWb20Hyd0DOjlGFOgNkPkRTeaKZ0ywT/I3sVzDiqo//jZSzN
bqU3TyxDVWPcZfyTYWrmd1PqesWRA/47klOO/D7Vsq3DmDLTXI3IUO7VBJQ3qi8r
SbaO52sfUH4tyvBIXtlNJZgiVl3FyDW02cQBptLF5WIhBNVcfSTx5dElNPahdQr/
nT3BWi1xxkk45ZBfGfyBZ4XMYMTH9SCRePEpvELjOtOr3EmzFG0/mIAFeJ/IsTVL
F96L1RbjG54xTQ4=
=R8sx
-----END PGP SIGNATURE-----