[CLSA-2026:1793099100] Fix CVE(s): CVE-2026-84732, CVE-2026-84790

Type:

security

Severity:

Important

Release date:

2026-10-27 11:05:12 UTC

Description:

   * SECURITY UPDATE: Peer impersonation via a certificate subject field
     containing an embedded NUL byte
     - debian/patches/CVE-2026-84790.patch: reject certificate subjects
       with embedded NUL bytes in x509_get_subject() and the field
       extraction helpers in src/openvpn/ssl_verify_openssl.c and
       src/openvpn/ssl_verify_mbedtls.c
     - CVE-2026-84790
   * SECURITY UPDATE: Remote denial of service via TLS retransmit timeout
     integer overflow
     - debian/patches/CVE-2026-84732.patch: cap the exponential backoff of
       the reliable layer retransmit timeout, limit --tls-timeout and ignore
       ACKs for packet IDs outside the send window in src/openvpn/options.c,
       src/openvpn/reliable.c, src/openvpn/reliable.h
     - CVE-2026-84732

CVEs fixed:

Updated packages:

openvpn_2.5.1-3+deb11u4+tuxcare.els3_amd64.deb
sha:b02ee090da8ac3af257dc9c74ccafcde933912b1
openvpn_2.5.1-3+deb11u4+tuxcare.els3_arm64.deb
sha:88cd199f6e0a42289483cc55243e6c705adec001
openvpn_2.5.1-3+deb11u4+tuxcare.els3_armel.deb
sha:3713d825fd54dc720e2ca3259a2c109f68ff112d

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.