36d3edc435
The OpenVPN community project team is proud to release OpenVPN 2.5.2. It fixes two related security vulnerabilities (CVE-2020-15078) which under very specific circumstances allow tricking a server using delayed authentication (plugin or management) into returning a PUSH_REPLY before the AUTH_FAILED message, which can possibly be used to gather information about a VPN setup. In combination with “–auth-gen-token” or a user-specific token auth solution it can be possible to get access to a VPN with an otherwise-invalid account. OpenVPN 2.5.2 also includes other bug fixes and improvements. Updated OpenSSL and OpenVPN GUI are included in Windows installers.
13 lines
470 B
Text
13 lines
470 B
Text
# $NetBSD: Makefile.common,v 1.21 2021/04/22 13:53:15 adam Exp $
|
|
# used by net/openvpn/Makefile
|
|
# used by net/openvpn-acct-wtmpx/Makefile
|
|
# used by net/openvpn-nagios/Makefile
|
|
|
|
OPENVPN_DISTNAME= openvpn-2.5.2
|
|
OPENVPN_DISTFILE= ${OPENVPN_DISTNAME}.tar.xz
|
|
OPENVPN_MASTER_SITES= https://swupdate.openvpn.org/community/releases/
|
|
SITES.${OPENVPN_DISTFILE}= ${OPENVPN_MASTER_SITES}
|
|
|
|
OPENVPN_USER?= openvpn
|
|
OPENVPN_GROUP?= openvpn
|
|
OPENVPN_PLUGINSDIR?= lib/openvpn/plugins
|