Comment 1 Matthias Andree 2026-07-01 18:49:21 UTC

Created attachment 272344 [details]
drive-by fix for VuXML extra validation to avoid invalid escape sequence warning from Python 3.12

This fixes the following error:

    ports/security/vuxml/files/extra-validation.py:13: SyntaxWarning: invalid escape sequence '\|'
        re_invalid_package_name = re.compile('[@!#$%^&*()<>?/\|}{~:]')

Fixes would be doubling the \\ or making the re.compile argument a raw string literal; I found that R'...'  has better tool support than r'...'  and is more concise than counting backslashes, so I went with R.

Comment 2 Matthias Andree 2026-07-01 18:50:16 UTC

Created attachment 272345 [details]
VuXML entry for half dozen CVEs in openvpn < 2.7.5

VuXML entry

Comment 3 Matthias Andree 2026-07-01 18:51:48 UTC

Created attachment 272346 [details]
OpenVPN security update to 2.7.5

This also contains one additional fix that came up during poudriere testing on 14.3-i386; on i386 sizeof(size_t) < sizeof(off_t) and clang complained that it couldn't assign a file size into a size_t.  That fix has been submitted upstream for review and potential inclusion into OpenVPN's master, release/2.7 and release/2.6 branches.

Comment 4 Matthias Andree 2026-07-01 18:53:21 UTC

Everything available through https://github.com/freebsd/freebsd-ports/pull/550 as well

Comment 5 Matthias Andree 2026-07-01 18:57:30 UTC

Created attachment 272347 [details]
v2 patch to update openvpn to 2.7.5 (prior was missing the off_t/size_t fix)

This is the OpenVPN 2.7.5 that adds the missing new patch for the size_t-safe range check for off_t that I'd promised.

Comment 6 Matthias Andree 2026-07-01 18:59:36 UTC

Comment on attachment 272347 [details]
v2 patch to update openvpn to 2.7.5 (prior was missing the off_t/size_t fix)

Sorry. I have the openvpn buffer.c patch inside the VuXML. Will re-upload patches again shortly.

Comment 7 Matthias Andree 2026-07-01 19:04:03 UTC

Created attachment 272348 [details]
v2 of VuXML entry for half dozen CVEs in openvpn < 2.7.5 (now without unrelated openvpn patch)

Comment 8 Matthias Andree 2026-07-01 19:06:27 UTC

Created attachment 272349 [details]
v3 of  OpenVPN security update to 2.7.5

Now with the right patch for openvpn's buffer.c file in the right of my patches (the OpenVPN 2.7.5 update patch, not - where I mistakenly had it previously - in the VuXML entry patch

Github pull request also updated.

Comment 9 commit-hook 2026-07-01 20:09:48 UTC

A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=7bcce8a1bb5c23d738b378619625289403dffe37

commit 7bcce8a1bb5c23d738b378619625289403dffe37
Author:     Matthias Andree <mandree@FreeBSD.org>
AuthorDate: 2026-07-01 20:01:15 +0000
Commit:     Vladimir Druzenko <vvd@FreeBSD.org>
CommitDate: 2026-07-01 20:08:53 +0000

    security/openvpn: Update 2.7.4 => 2.7.5 (fix 6 CVEs)

    Changelog:
    https://github.com/OpenVPN/openvpn/blob/v2.7.5/Changes.rst

    The upstream's signing sub-key expired yesterday, new key provided via
    https://swupdate.openvpn.net/community/keys/gpgkey-F554A3687412CFFEBDEFE0A312F5F7B42F2B01E7.gpg

    PR:             296429
    Security:       ffa897a0-756f-11f1-b291-a74de6bb0320
    Security:       CVE-2026-11771
    Security:       CVE-2026-12932
    Security:       CVE-2026-12996
    Security:       CVE-2026-13117
    Security:       CVE-2026-13122
    Security:       CVE-2026-13698
    Sponsored by:   UNIS Labs
    MFH:            2026Q2

 security/openvpn/Makefile                               |  5 ++---
 security/openvpn/distinfo                               |  6 +++---
 security/openvpn/files/patch-src_openvpn_buffer.c (new) | 14 ++++++++++++++
 3 files changed, 19 insertions(+), 6 deletions(-)

Comment 10 commit-hook 2026-07-01 20:18:54 UTC

A commit in branch 2026Q2 references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=ca7f5416e529ce5967fdb2b19a0572d7ee52d520

commit ca7f5416e529ce5967fdb2b19a0572d7ee52d520
Author:     Matthias Andree <mandree@FreeBSD.org>
AuthorDate: 2026-07-01 20:01:15 +0000
Commit:     Vladimir Druzenko <vvd@FreeBSD.org>
CommitDate: 2026-07-01 20:17:34 +0000

    security/openvpn: Update 2.7.4 => 2.7.5 (fix 6 CVEs)

    Changelog:
    https://github.com/OpenVPN/openvpn/blob/v2.7.5/Changes.rst

    The upstream's signing sub-key expired yesterday, new key provided via
    https://swupdate.openvpn.net/community/keys/gpgkey-F554A3687412CFFEBDEFE0A312F5F7B42F2B01E7.gpg

    PR:             296429
    Security:       ffa897a0-756f-11f1-b291-a74de6bb0320
    Security:       CVE-2026-11771
    Security:       CVE-2026-12932
    Security:       CVE-2026-12996
    Security:       CVE-2026-13117
    Security:       CVE-2026-13122
    Security:       CVE-2026-13698
    Sponsored by:   UNIS Labs
    MFH:            2026Q2

    (cherry picked from commit 7bcce8a1bb5c23d738b378619625289403dffe37)

 security/openvpn/Makefile                               |  5 ++---
 security/openvpn/distinfo                               |  6 +++---
 security/openvpn/files/patch-src_openvpn_buffer.c (new) | 14 ++++++++++++++
 3 files changed, 19 insertions(+), 6 deletions(-)

Comment 11 Vladimir Druzenko 2026-07-01 20:22:15 UTC

Thanks.

Commit the VuXML entry left.

Comment 12 commit-hook 2026-07-03 06:33:17 UTC

A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=29309837995452589b5a7ac208dcbfaa5d673fa2

commit 29309837995452589b5a7ac208dcbfaa5d673fa2
Author:     Matthias Andree <mandree@FreeBSD.org>
AuthorDate: 2026-07-01 17:27:45 +0000
Commit:     Gleb Popov <arrowd@FreeBSD.org>
CommitDate: 2026-07-03 06:32:00 +0000

    security/vuxml: add security/openvpn[-devel] vuln entries.

    Aligned with Gert Doering for openvpn-devel.

    PR:             296429
    Security:       ffa897a0-756f-11f1-b291-a74de6bb0320
    Security:       CVE-2026-11771
    Security:       CVE-2026-12932
    Security:       CVE-2026-12996
    Security:       CVE-2026-13117
    Security:       CVE-2026-13122
    Security:       CVE-2026-13698

    Pull Request:   https://github.com/freebsd/freebsd-ports/pull/550

 security/vuxml/vuln/2026.xml | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

Comment 13 Mark Linimon 2026-07-18 08:29:42 UTC

^Triage: flag arrowd in case MFC of VuXML entry is needed.  If not, please just
closed.

Comment 14 Matthias Andree 2026-07-18 10:10:51 UTC

(In reply to Mark Linimon from comment #13)
Thanks for the reminder.  I'll have that as I'm also triager and it's my port and let's not shift the burden onto arrowd@.

We do not MFH VuXML entries, the upstream database is generated from the mainline, and it wouldn't make sense to build two views of vulnerabilities, that's only confusing.  

The things to keep in mind are:

- be sure that if you patch /directly/ on a quarterly branch, you must make sure that the "main" branch version is greater than or, in case the versions are the exact same, equal, than the version on the quarterly branch so you don't have the version go back when the next quarterly branch is created by portmgr@,

- that the main line VuXML, when dealing with affects/package/version range, needs to look at both main and quarterly so the reporting is also correct for quarterly (which may involve PORTREVISION bumps)

- everyone is aware that everyone else might PORTREVISION bump, so if an UNFIXED vulnerability is reported, don't limit the upper bound of the vulnerability to the current PORTREVISION, but leave that open-ended until the fix lands in main and quarterly (assuming it's needed on both) and then update the affected packages' version ranges.

Thanks Gleb for the commits and surrounding work.

Comment 15 Matthias Andree 2026-07-18 10:12:36 UTC

And last but not least, of course thanks to Vladimir for the commits and the surrounding work.