6186fe732b
Fixes two related security vulnerabilities (CVE-2020-15078) which under very specific circumstances allow tricking a server using delayed authentication (plugin or management) into returning a PUSH_REPLY before the AUTH_FAILED message, which can possibly be used to gather information about a VPN setup. In combination with "--auth-gen-token" or a user-specific token auth solution it can be possible to get access to a VPN with an otherwise-invalid account. OpenVPN 2.5.2 also includes other bug fixes and improvements. Add CI build test script. Signed-off-by: Magnus Kroken <mkroken@gmail.com> |
||
|---|---|---|
| .. | ||
| 001-reproducible-remove_DATE.patch | ||
| 100-mbedtls-disable-runtime-version-check.patch | ||
| 115-fix-mbedtls-without-renegotiation.patch | ||
| 210-build_always_use_internal_lz4.patch | ||
| 220-disable_des.patch | ||