f52f437070
This is a bugfix release containing security fixes. Security Fixes (included in 2.6.7): CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly use a send buffer after it has been free()d in some circumstances, causing some free()d memory to be sent to the peer. All configurations using TLS (e.g. not using --secret) are affected by this issue. CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly restore --fragment configuration in some circumstances, leading to a division by zero when --fragment is used. On platforms where division by zero is fatal, this will cause an OpenVPN crash. For details refer to https://github.com/OpenVPN/openvpn/blob/v2.6.8/Changes.rst Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
20 lines
763 B
Diff
20 lines
763 B
Diff
--- a/src/openvpn/ssl_openssl.c
|
|
+++ b/src/openvpn/ssl_openssl.c
|
|
@@ -1347,7 +1347,7 @@ err:
|
|
return 0;
|
|
}
|
|
|
|
-#if OPENSSL_VERSION_NUMBER > 0x10100000L && !defined(OPENSSL_NO_EC)
|
|
+#if OPENSSL_VERSION_NUMBER > 0x10100000L && !defined(OPENSSL_NO_EC) && !defined(ENABLE_CRYPTO_WOLFSSL)
|
|
|
|
/* called when EC_KEY is destroyed */
|
|
static void
|
|
@@ -1508,7 +1508,7 @@ tls_ctx_use_management_external_key(stru
|
|
goto cleanup;
|
|
}
|
|
}
|
|
-#if (OPENSSL_VERSION_NUMBER > 0x10100000L) && !defined(OPENSSL_NO_EC)
|
|
+#if (OPENSSL_VERSION_NUMBER > 0x10100000L) && !defined(OPENSSL_NO_EC) && !defined(ENABLE_CRYPTO_WOLFSSL)
|
|
#if OPENSSL_VERSION_NUMBER < 0x30000000L
|
|
else if (EVP_PKEY_id(pkey) == EVP_PKEY_EC)
|
|
#else /* OPENSSL_VERSION_NUMBER < 0x30000000L */
|