list-openvpn-nl

list-openvpn-nl@lists.sentyron.com

47 discussions

RHEL 8 package for 2.5.11-nl2 added
by Max Fillinger 13 May '26

13 May '26

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello! Unfortunately, we forgot to make a package for RHEL 8 when releasing OpenVPN-NL 2.5.11-nl2. We apologize for the inconvenience. We have just uploaded a RHEL 8 package. Best regards, Max Fillinger -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEpK49A7EHchkpcCjYxU5xiqPE8EQFAmoEhWMACgkQxU5xiqPE 8ET5yw//Qc8C3racTT38qg8Yog3KxYANvQXG2PoJvWqR376KE5bnSBfQ25p0UEL7 fk95eh/om1gG3CO/0cN07oHwVqFg2IR1i3WVD9gOtZedKLTW9CNhjqTqgSWcEggZ kXdDgEysRugff6SW3E4a6rmi+m9ZDFqRx78NQuIqU4S50NnC1AVB2mQWELuETgCS ChpZtP18Ka9qkKS/Fu03/SyvOWjL36bO/Sod+hWehvjQt/YYzVACuylDgvvAShxa 2RD7krs/LDJWKVlHaklCZOQ3NVXnninKLZJS/tUMsM4vNewVQT5pai67Wmsk4Dny K4N44LVUYr2anO5Isq8UDeUqvXSx4DcYe1VvZQQmeWaQO5V4Y7HZoJA/2pbUEgtC 1/G87QR+AWcDhVzL2ZevJmIvVmmimaiqSXhq+joOltY+LRZEvhmdCH+k7YD3uF6Z Bko1KfFCFZigEzymxYaKsiki5welXUJXfx76+qoIewEZ2X1JmtjOowUZYXCHbQDS ebDQjNIYiDOn1uhsMzw41pbncySRMLKRZ+h0KvcgN6MY+xNGhnhxR9mf6zSzROoF I+7i6PUnCH+CAjbzYewM9nIXB95C/WN0j4V6V7fDppqIR4aOrmycor8WOo39TfBH JMz+BppNrSzFHOAhRrLscfJ6sU40ewlshn3hW94cPx1AG8sEwlY= =TwMr -----END PGP SIGNATURE-----

1 0

OpenVPN-NL 2.5.11-nl2 released
by Max Fillinger 12 May '26

12 May '26

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello! We have released OpenVPN-NL 2.5.11-nl2. This release contains backported fixes for CVE-2026-35058 and CVE-2026-40215 and should be installed as soon as possible. Previous releases have been marked as untrusted on the website. On Linux, you might receive warnings regarding our name change to Sentyron when updating. Please check the output of your package manager to make sure that it performed the update. The Windows release has been signed with a new key: https://openvpn.sentyron.com/repos/sentyron-win.pem The fingerprint is f89b8466bb696e037917bced17dc19bcb2b58bc9. This key does not yet appear on the website of Unit Weerbaarheid. You can check the authenticity of the Windows installer by verifying the SHA256 hash in https://openvpn.sentyron.com/repos/sha256sums.txt and checking that https://openvpn.sentyron.com/repos/sha256sums.txt.asc is a valid signature for that file made with our code-signing GPG key (https://openvpn.sentyron.com/repos/sentyron-gpg.asc). A note about the tap-windows6 driver: We are including an older version of the driver that was signed with our previous key. This is still accepted by Windows due to timestamping. We hope to make another release with an updated driver in the near future. Best regards, Max Fillinger -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEpK49A7EHchkpcCjYxU5xiqPE8EQFAmoDRfMACgkQxU5xiqPE 8EQxBA/+LJDDg+hjvvHjEG5E4ChYqHBmAG2F1cC3yNWsdaGUF8Ab0WuD6VtZQv6k tZM5mD9vUQULpt+3Gh5Z2UvS4fgS97L8N8mYfOTquG75bLmjk+uJjBsfMwcZ7hjU 5mGhbPukAVCyY4LHTWNDBvy5sUqZSB2O/Y4NrTG4LFXmfT57mhB7cO8fOOX/hzYp /G4v1CRQgi3ytpeSGJGE3fgoZYzMoZ80oaJMA56ccpms9Wni9sc1VI2QN6sJYjxb U6CSkq4rtm9k7cCr+0Unf0aheTqET+ReZ6tXjWFosmgCV/nCJ3U5E39XI0XIOWtM cSUzV9skZFnzFCt7f5b+1h8gUvMZlP2QIU1/r9QAKuLBgvXYDaSOyOofkRpJ1CwX lGOUTxqB7s8n5YK/cgyn0JQuchcaNrSBqgCTBqLOLhQn7LfnzKHQBaMTLtbCL63e kuXV68mHWHdbRLfF9KvmB4K19gvUZI5W6DFPHuEFwVXpSkiFgZqzqUDOY8V79xum YJvU/T6jq7zPdBXhevjFDG3hvmjsIc9lCg1d6+fk+pL1GrJYCxHAQkwm/67MDIAm g1N6zSjB/3t229jr8U5yN18O8GCQ7np2eEXbHDptVLJA2EETHhJdg7cZuvAHhbJq uRuokbJ+vWmtqUdTTm6CkHDndxCDD79/1vyU6D5g0+t7cJ4hy+I= =KALm -----END PGP SIGNATURE-----

1 0

CVEs in OpenVPN-NL
by Max Fillinger 24 Apr '26

24 Apr '26

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello! Two CVEs have been published for OpenVPN. These also affect OpenVPN-NL 2.5. A new 2.5 release and a 2.6 release are currently in the works. CVE-2026-35058: A malicious user with a valid tls-crypt-v2 client key can crash the server by sending a crafted packet. CVE-2026-40215: A possible use-after-free read on the server if handshake packets arrive with very specific timing. Best regards, Max Fillinger -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEpK49A7EHchkpcCjYxU5xiqPE8EQFAmnrbu4ACgkQxU5xiqPE 8ER1xA//RZZAHKZ2Fs1w9ttqqJFcrB4ZB7BimdWLlC/TpTEk5oWmGUyp9UYEzj3l wwopEQe54aahTMRXtbs2ddgPwnO+H4L7CHCY1BS/HfQIgTls6aQMvUAsjQSHbR1S vPWx5mET33CytBnq1Mq98Fvxi+MpGtJyqPW76xr4R/TaQTN+aKw0CrNy/Qp6xlPL RmLM6SOL6UgpaqxCnAN3IdhsDYuHp8h3wE+GOWRTAC2AaXjYfnEE+eMZYGvKinz7 yoLAltWro6SJ++8+x0FixLgesGNbUBpknHXhPoO13fLT2EIxXRT1CQ20B0H91s3r buzZSu/gT1rX6cPPtTeSLoJdDz2kPkdU+pqrPJychoiZaInUhww6H4pAu2CvSv1f IHukUEEe7SkRSYF45GiYIMrdngXYQomu/J/oj7LrvjW02MlQIZGdrG/gSYoU1lWJ POp3t72VsTBpRts8vq1SeFBFb6SOLqtPpt/cb14o26j3uG5KtCnClytn+zswx5ak nT0yuceO1agRW5kFA+xZwA2LbaHojy3WwepM+jt0BKLpSiNTYRBkO8jv9M2QMgkb Eyk7nrIySe5GwkIG05m4jE6RUFp6q5ZfWZNMueNvaMJCxdTWIhtyxdjJKgU5ut6t E5ZdI7blvuPyJEXEx+QLYkiXlI67CXuGEAHYyCPP5IDUGPj/zbY= =B3W7 -----END PGP SIGNATURE-----

1 0

Mailing list key updated
by Max Fillinger 30 Mar '26

30 Mar '26

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello! My signing key for this mailing list is about to expire. I have extended the validity period of the current key for another year and updated the file https://openvpn.sentyron.com/sentyron-mailinglist.asc. The fingerprint of the key is: A4AE 3D03 B107 7219 2970 28D8 C54E 718A A3C4 F044 Best regards, Max Fillinger -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEpK49A7EHchkpcCjYxU5xiqPE8EQFAmnKpcAACgkQxU5xiqPE 8EQX1BAAxdRXvUjGGs/Wf+notOo3yg1QLAupZsB4b6WRWvn2a5tK7piHsTt/B5s1 /+gcAoNzzt+FXafL9uu/26H2uwwaj9133Bw78JXtwfh6npr7v8wfs4CZO7oS+TLn ehtHtM+R9ub26pYfNybW5iFJHxjZ1jSl9fOt1fBKDvTWt7G3+ZJmol7JNdRolIY7 wfhpw1BOxBAmTM7BU5wDqWJJVYfZx72vvR+YL5ky+q5vAQ8QBV2TJ22Qqn3Uf49s l9TFdzjMozeD5E7OdzE0vsDVSG+w5yclXM4P0tES1MdW9Q08Nyixw/kf0Y3oIb8p Lt5QhSNzHNgFdSeTCQfNWePysNpRES9F/K5Gb1o6AFB9bQEAjzo9FKOssQkhvXe2 Ox6WYgd0ksWoEjwH8GTgeunfJz6k1bfVPFVbAQHJ77S/qmQHHrkAVULkbV9UB5Am JI4dlG6nwXp5+wwM8EN4siW9vsVj5DuoiB+klxLN4DvW7/LxteeBQqblIGsneGbN boJykiAXL89pb6ZtqxQ21vNwT6DdtnNAnLngfJKrAaihwOLhiuaFzYpYP1qzHbk0 Il7kkP+YVTvMDMsE0Tppq9lrUmekq5AHh+3xdHR0BpQscEuyMNneCeY8Ee2glSbX C9tv4ChNXoIcJABwJvYLg8HlRLToM51UlMvOHvNevA4G+1yuQH8= =nhLS -----END PGP SIGNATURE-----

1 0

Fox Crypto becomes Sentyron
by Max Fillinger 04 Sep '25

04 Sep '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello! As of today, Fox Crypto is called Sentyron! See https://sentyron.com/new-name-same-mission/ for the announcement. The OpenVPN-NL website can already be reached at openvpn.sentyron.com. We will update the content with our new name shortly. Starting now, you can update your package manager configurations by replacing openvpn.fox-it.com with openvpn.sentyron.com, though we will redirect the old URL for a while to keep existing configurations working. Unfortunately, we don't have the new mailing list server ready yet, but in the future, you will receive announcements about OpenVPN-NL from list-openvpn-nl(a)lists.sentyron.com. Best regards, Max Fillinger -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEpK49A7EHchkpcCjYxU5xiqPE8EQFAmi51soACgkQxU5xiqPE 8ETzVg/+M6kYYtUESbrJyoWGVhCXJStgs9DWVGm138RtrSC3VfhaEEEvCdCT9rzC Z2a5inDfwXlCD/G39X9iRxpmKSxf6NeFbe9YgFb7tQy8jI+X5kwUFNyslkvlS48J jnxr9/4mMW1RI75E4saSeAFy3HDFdCq1yJiW8XDHXr4mtgWsduX902VtnkEJpGKO enqFsfLEKtLwVSUMI4FtV0THPUU9m8vGjlTyDZyW1d+Hdtp6NTUGPRO7R58wuS9H z4Ze4LbOkPSKtwHtHPz2vl/cluDeLKgry6Do1mzy7xXyU9RgaHkWFsOhqFsCSEuu 2RnombGTSEii30VrieBkch42X5T9lN7EfumVkfbt/dAAOh0K3KV6VdTvC2ct2xlA x9Qz0snR6wHUTggcEV9ghsjVUnNYXQvo9LEcnVXUEsOldLLt4+C4R1/VCeLi2xqc aLk8AZziHB1eLmZM+ktwMeOa0hY1WRkL3od+/ZVpXav8Y92aT71ICcXy71auyJ13 2y+mA3PMAACktMApAKjei5EjWlebYVtWGSDljZKPN5TTdGPrLzMhrB7qjoWj8rl4 WAEDh6bJ0oe1DBjZgI5xjaS4aCUGgA6r4N4XJEXT2OeupVKGlSY/77lZpqU4I4ez OLKp+lv2w/BswvNHC9kgoZBXstiVUeAwpo1nCEPXPk8xJK/hfzo= =Rwlm -----END PGP SIGNATURE-----

1 0

Upcoming name change on September 4th
by Max Fillinger 29 Aug '25

29 Aug '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello! As announced previously, Fox Crypto is going to change its name soon. While I'm not permitted to reveal the new name yet, I can share a definite date now: On September 4th, the new name will be made public. Around this time, the OpenVPN-NL website will be reachable under a new URL. In order to not break your package manager configurations immediately, we will redirect openvpn.fox-it.com to the new website for at least two months. The address of the mailing list will also change. On September 4th, I will send a last e-mail on this list with the new name and URL. From then on, e-mails will be sent from a new address. We copy the list of subscribers to the new mailing list, so there is no action required on your part to continue receiving these e-mails. Best regards, Max Fillinger -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEpK49A7EHchkpcCjYxU5xiqPE8EQFAmixu/gACgkQxU5xiqPE 8ERTexAAvGqAe15igqlHqVKwSx559nW3K6RoOlkcaTyoMpZIDzgAd23UbEObYAe+ v0K+Hy4N+9p3Xb3ZXQXnv9b2bzEvvpgcMOWSC1zvZQ2v3GtRsFsMsiBBaHj3LD7j u1bgEtoZMoN8hY0fsGGrqoOHkx4q0AuNE6o2A43QwmwJXVR/9tu6vAZLxAt9pLVb I/DYnOrYJig6sOyudB2YeqS4hyZHotxh9gY2T5qxGIYEH5mITu6dR315nw2F43SJ kPQAmOxp2u44eQ9FSVMII0e+SGR2r3ecCDr/8wO+luMd7qLvzVgGzqJw1Higuszv g6fb6pZbGoOhMH4XymsX2r3O5otwnJh9XHmwP10gpAoOjb6uGA7Nx6o9eljKXeXX Uf2DSeWkUusIsr08LexV2lbkxAQe133Bd/WfEQ9+qqfkgEbdEUk1aqTYL6wSTMNm 03Non71DGdoecHvY+vXlkbqp4vB6X87uTaJwRGjB8blRhBGixEUPuzBht/y5BuuM qyiJJl/QCNFnf6aUpSRgNKqh4PI379zB0c3JHWWV0r0RTp2LEEdWdiVao45WVP6L rLLHyMBuvxN8g6aD/qlWxICokenrx5zPy+PiCfjDzkW8N9JCKtgvmhHhlA3z5dJb 6OCY1SO+tSQ022/LMVPcJI0OJbl1DzCZqK89xcpNRlbnpCw8WrE= =43Sy -----END PGP SIGNATURE-----

1 0

CVE-2025-2704: OpenVPN-NL unaffected
by Max Fillinger 03 Apr '25

03 Apr '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello! Yesterday, CVE-2025-2704 for OpenVPN has been published. It affects OpenVPN versions 2.6.1 to 2.6.13. The OpenVPN community has released version 2.6.14 which fixes the vulnerability. Since the current version of OpenVPN-NL is based on 2.5.11, it is not affected by the vulnerability and no action is required. Best regards, Max Fillinger -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEpK49A7EHchkpcCjYxU5xiqPE8EQFAmfuzoIACgkQxU5xiqPE 8EQ3HA/+MJNIR5xITpQBvaICQlInxiNtEdGert7D1qVNp95FxX+a2+yGfhFJaoSS gyaqUwRXzDwE1hEL63wSTNCXRySWDK15Ux3Y/Ot0HeCENgKnRmE8e/MhN6F/ufm3 vWOfxF4/62QfAUNzrYlhhaAiG5TnvpR4YNngDrWjJtJmNODQvVSIzmMuD3PNgg0y yN5tNQTgG6Eb3aZkaKff+hItOc9gPUJiJis8QmXU/W3LmZq88kundpfc4PEKBi86 dMUXKETwYsolEXI9rphAbIyzg2vRcr4YXFt3reUCgWld5bQpQ+5WiebSqRLRX+lK yGABrbezz7ierthq8KfBhxsswPxkVNwDUFbguUX6yE33faxkFyfHStM79YiXlPi1 +vYammGGOwEZciwzS2LejZOezq7BkVJUFD5VgPDWTxY3Ls2ZQ40Wg9jJE741V+G4 6j4BKidn+821Qr7knnfXeWQzEvcgTeGC+dW/Sn/+1nR7j2spnOPgyokHNxJUes8F o+kb3Y9puoLyl3IUHdsguvfqSM109OukJ06WyR8JR04pPJ+a70HHNaAE8+j8mkEo njE4pIA6FWSoLTXLiPYB12hdyuxSsTWao3EwvJ9Rnf4fQSCZMmHicAEmeQrAL1u2 SVH3UJsX5o1aPNqGw56axwAGVMdx6rQ4ug62+roS/BdmGuVvn3M= =thQh -----END PGP SIGNATURE-----

1 0

New ownership of Fox Crypto and upcoming name change
by Max Fillinger 02 Apr '25

02 Apr '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello! We are proud to share that Fox Crypto B.V. has been sold to CR Group, a European leader in secure and sovereign communication solutions tailored for defense and government agencies. We will continue developing OpenVPN-NL, but, since Fox-IT remains with NCC Group, Fox Crypto will change its name. We expect to announce our new name within the next 6 months. Then, the OpenVPN-NL website, mailing list and package repositories will move to a new URL. We hope to have some grace period where both the old and new URL will work. Please continue to monitor this mailing list for further information. Best regards, Max Fillinger -----BEGIN PGP SIGNATURE----- iQGzBAEBCgAdFiEEXj3Vjj5AbsDlPfHO5IsYow7qaagFAmftPa4ACgkQ5IsYow7q aai0oQv9HnOEpGeKfnHpPWD6k1Qj3ZU4c/vw1F2mvCoP/VUhBj1G4dU2FSIM8t3J eVuvKhKjICJP5aMGKDnqK4mS3qAiQ4BVvT40sKfJqkpzZcyPQEwlDYOt7ds7CvUR nVx748L+NOF3WaRttWPTvLe1GTGobpX4B/qozOAeJG3b/GlN1R1XCCidmBHsxmYT DK7h7I+wHNuzvnx4tyO6pXpVSl1JtsL8is+91D1lxlCtyrzTTa4P3GohnAykey/T vGVJf1xElyZmFgYw7rXqACDhvtbT/5QehdPn5ynGoY0cGxngRHU8wpjBCqih2C1q A4wh1hyWCGyybeCtigglP+Ms7/1kSs9bBG1T9WNbp+xVS4b90lU5pRcawQSk0KEB nEOdBCt8SiDQTfRB8+uAWy7Ih9HY0DD0P09kLWv+bMEhb1O/1H1wX5xCyEg5HQ19 dgajEnS9+mxfE6BS1BSTB0IwO4YoXhv2A4fHX7DQOCSvDLJXASUpQeqbYnX9de2R O6d2+q7piQIzBAEBCgAdFiEEpK49A7EHchkpcCjYxU5xiqPE8EQFAmftPb0ACgkQ xU5xiqPE8ESMGQ/+I0hqVjNQF/lNH3+3sxZ2U0Ux4GXzWBjhrcKYZ7CalljBKzml Vc3zukWcCAa5pM8+NNjtb1trwx+sSqpNwqblCWPiXBdci3c12joLi1WBIkVhUnCN f4ciC6gbfGXg+p9lmQFZFnSCAElRdzhhw73zky3PCY2QtNKq3JmBqjb29+M3lHWX ORYt5ScoXBcCXK5HSxtbQRBMJzQY6V0qn/rLgN7QRbT5GPc51dFvxKQRNyeOLQ1T pWMkNASyyUlgEiddR+qMiaObk5XJ8RuRojaezYxoUkblI8ldvYyugNaVOw+EpQe+ 6wydlsUclCP+ZCd4hNnlK4STlBgoS81KBhyVcjOP1MPB0jXEWkhDzcWW0LPdCIxD /yBn6Pq0pHQUcHKGp75TN/MkC8tdKRw1+Vh+CGF+/Dsqj/g5VrOHkcN85Rtg2VG2 5nCkEP72Y/P/gqweRAEcBMcm1Di2KkoR1Xza1AzsOs1MsrWfIw8gdS2p1oXo/2RS C8hTYh90OYPR6sEkcU7qBY6XXtShIGAYAoujYyZMFCSSvXVC12gEpxROuVhj5fXA d7RtsjyDMJadDw7EJel3vAymqYKNZzg0rsJ371RAWFOx989bEF4jI5eJ3l5spFWN j+XAH9dDeVR+NxjfiDv+GaX0wzaPu6NzPrGYi9jIXrveJfrvJ3gu2vEN7v0= =UYpt -----END PGP SIGNATURE-----

1 0

New GPG key
by Max Fillinger 02 Apr '25

02 Apr '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello! Since the GPG key I'm using to sign these e-mails is about to expire, I am going to switch to a new key. I have added it to the public key block at https://openvpn.fox-it.com/repos/fox-crypto-mailinglist.asc. The fingerprint of the new key is: A4AE 3D03 B107 7219 2970 28D8 C54E 718A A3C4 F044 I have signed this message with both the old and new key. Best regards, Max Fillinger -----BEGIN PGP SIGNATURE----- iQGzBAEBCgAdFiEEXj3Vjj5AbsDlPfHO5IsYow7qaagFAmftM3AACgkQ5IsYow7q aajNygwAp6rzMgWCMQnzSwDZ3wQpBdBEpYKZAmAzQuJKPj9WIlmb9TNOzdmWdfEl dB+Z+xK3DSPyDVCDIh+NliG7lciOR1yz+4JXOmMUbfzKL9nA+eIcdhuonarKRDiI Acw8XFIS2UdCQDWxmEOYvaqbW3dAY76C6DRR8eWEOqFjBvb4uWRYUQTKoVlIjkik rJppbktM/74yiKQyEwjWhZ/hiJNlNg5UNbwRSG4XHcsWpDoPvMnEHIc1dsxwywlO TciPXyNmGyzBrqov+Ppft+3MAl+Dcicy4JP0zdEGqvSbbDt2wjy3rtAu14sxwdl9 qTE5w6Z1ZxhbkHjJ4Vo+HTCEdsM/djP6RXWuscdRZaO0JKphp3jw6PMIE1QL0EBX I9le8Vr1MrLQ6CsuWfjr5xMeS1hoNybpZe+UeNtvS5StyO4UuiB+WxjDesp8BK/o OjHb/pIaCy9YHJQ+Z+iJDZVbWgmPIazZxz1/q9XbPvZeV3AkLiqRLdsomikurOGs LlQOVpQ8iQIzBAEBCgAdFiEEpK49A7EHchkpcCjYxU5xiqPE8EQFAmftM4QACgkQ xU5xiqPE8ETsWhAAvuHxmcuLFqCBb9mYRDYktaRujAMBjAs7Wn2pL6OzVuyBXWW7 YZMhz2mtYUlXeD0GQuLjCUcO3Ox9ApXLfLNlAhhxEm6Nu7IwJMutnrcjPg4EqaaN Vgk4J8rb0l9w2F+T3iJKd9sC3slvOlBibeMH4s7LqYXtk06ieMywvWF1uMQ17vCz Hk36U1SOA/oX9OfsVBKEAS/ntIIIUSV6ovrLBF7uLATjPRpLRn9bA3xUtNZMRiKi VrCBdjBtppvL5OvhRfJ54ZHZjtg1YkpWhf5DL2mpwyzzeqhA1IalL+ELZRnrP/LR qZUP1gJZkDWQZvJ1/NSfyw8k1mz3/9GnLaMCUXU4cumQjyQivKQ1m8Z9bLP/P0r9 LnYJXzNOL2yCkSTJyUD+2Wty+IG5RYeWG8DtKRT4QlFbjNBGMuAUu+018ERc9TEv N0NfJ5x0kNh8DibWrw9K7wta/ahm/eZvHbZbcJcNTGkz+tMFVPcZsNNHXrC8QYIs /tX4IMAoZByOHeueC8/0nJzE1jmKomnNNY9JNLDh10L843bQob8o1hHie/4+mYyU Brxex37T3k2OB51813d9Z/b26FD8vFvamT/eXkFExu9ebKTPutorfHR6z4880GnP F6RyCZAu6yWQntyrFga9zPRvULdSw0lJhClsxO88IPzSzQnj/sLA1v4CgcQ= =v6BH -----END PGP SIGNATURE-----

1 0

Mbed TLS CVE-2025-27809
by Max Fillinger 27 Mar '25

27 Mar '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello! A CVE for mbed TLS has been published, CVE-2025-27809. The issue is that mbed TLS silently skips validating the hostname on the server certificate if the expected hostname is not provided via a call to the function mbedtls_ssl_set_hostname(). OpenVPN does not use the TLS library to validate hostnames. Instead, OpenVPN itself validates the name on the peer's certificate if the configuration option --verify-x509-name is given. This check is performed independently of mbed TLS and is not affected by the CVE. If you do not use this option, the name of the certificate can not be validated because OpenVPN does not know what the expected name is. The deployment advisory (inzetadvies) for OpenVPN-NL requires clients to use this option to validate server certificates. (Appendix 1) Best regards, Max Fillinger -----BEGIN PGP SIGNATURE----- iQGzBAEBCgAdFiEEXj3Vjj5AbsDlPfHO5IsYow7qaagFAmflPOYACgkQ5IsYow7q aajgMQv/Ww3KQP2IFFoTqBWCqGNmeUtCunH/x6K87K4ifim99bnd1p7El0xrG6B0 2/BbVsrefmO0jdnsM9erCPxdt8EDnHHt+Sc+Xuk6DCGGfzRZuPhPDj4wU1XXvsJ0 xIEvDO7wz1LuWPI9iPQ8oswjjluA9pwfU5g+J7I34MIa7I2jvOoKyGb7p1uMPbzK qeUfjUaWCsjoRUtY36qZDOj50BR9JJnC1IvoGAXx1UQl7zzB5edL41W2Teu5MSXh hxRsEjfMZTMGE0/u2WuOaGGzltx1zeRoERdk8AOBsKdlC4C1Ue4lcCzfJ4vWGE7f UAtvWRX3oVLOHB1mi1fMaXxUo1GkvglxNpcfc05eTV0vxvJNhnc+kyF4ui0u/BFZ jLxaw0CgDmWaoUA3UF1G/OvE8OyktpSWOVp2JP0cQG0lwyDKGlb474u7jYo82v4/ tTPdaiJlkNPnZT7XiRlj6JO61zizVUNCybR6469vXtZUdLDaSATPq1r3PFDVaHsy Ll+6k6Bp =Izyt -----END PGP SIGNATURE-----

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

list-openvpn-nl