- 2.5.3 had a typo in the CVE ID (CVE-2121-3606 should be -2021-)
- 2.5.5 had windows paths with backslashes, which need to be doubled
(CVE ID typo also reported by "@attritionorg" in Github PR 165)
v2: SSL -> ssl, and .cfg -> .cnf
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Selva Nair <selva.nair@gmail.com>
Message-Id: <
20211227201616.13315-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/search?l=mid&q=
20211227201616.13315-1-gert@greenie.muc.de
Signed-off-by: Gert Doering <gert@greenie.muc.de>
- Windows build: use CFG and Spectre mitigations on MSVC builds
- bring back OpenSSL config loading to Windows builds.
- OpenSSL config is loaded from %installdir%\SSL\openssl.cfg
- (typically: c:\program files\openvpn\SSL\openssl.cfg) if it exists.
+ OpenSSL config is loaded from %installdir%\\ssl\\openssl.cnf
+ (typically: c:\\program files\\openvpn\\ssl\\openssl.cnf) if it exists.
This is important for some hardware tokens which need special
OpenSSL config for correct operation. Trac #1296
============================
Bugfixes
--------
-- CVE-2121-3606
+- CVE-2021-3606
see https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements
OpenVPN windows builds could possibly load OpenSSL Config files from