)]}'
{"id":"openvpn~1766","triplet_id":"openvpn~release%2F2.5~I16187153e5b107eb08ccb7c9c9ed4acd6377af0c","project":"openvpn","branch":"release/2.5","full_branch":"refs/heads/release/2.5","attention_set":{},"removed_from_attention_set":{"1000053":{"account":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"last_update":"2026-09-16 12:15:14.000000000","reason":"removed on reply"},"1000003":{"account":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"last_update":"2026-09-16 20:30:10.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"I16187153e5b107eb08ccb7c9c9ed4acd6377af0c","subject":"Backport stricter check for valid tokens","status":"MERGED","created":"2026-07-02 11:41:18.000000000","updated":"2026-09-16 20:30:10.000000000","submitted":"2026-09-16 20:30:10.000000000","submitter":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"total_comment_count":11,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1766","meta_rev_id":"97f0841c70d10bd2f6e8a41306da7cb605016d8f","_number":1766,"virtual_id_number":1766,"owner":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"actions":{},"labels":{"Code-Review":{"all":[{"value":0,"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},{"value":0,"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"}],"values":{"-2":"This shall not be submitted","-1":"I would prefer this is not submitted as is"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me, approved"},"description":"","default_value":0}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"}],"CC":[{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-07-02 11:41:18.000000000","updated_by":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"real_updated_by":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"reviewer":{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"},"state":"CC"},{"updated":"2026-08-13 20:07:36.000000000","updated_by":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"real_updated_by":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"reviewer":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"state":"CC"},{"updated":"2026-09-16 12:15:14.000000000","updated_by":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"real_updated_by":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"reviewer":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"state":"REVIEWER"}],"messages":[{"id":"04b2dd9e6fff031555e16ba0e3974102c724ddbf","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"date":"2026-07-02 11:41:18.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"cca7616832769b88eb8cbe4910e64069674c5f0e","author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"date":"2026-08-13 20:07:36.000000000","message":"Patch Set 1:\n\n(6 comments)","accounts_in_message":[],"_revision_number":1},{"id":"2a2dd7c22551d2d3390b2ddd59405f510b8f4f83","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"date":"2026-09-16 12:01:40.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"8f0cf4cce126594bf8343c97417d62b7d7d5abf7","author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"date":"2026-09-16 12:01:49.000000000","message":"Patch Set 2:\n\n(4 comments)","accounts_in_message":[],"_revision_number":2},{"id":"ba701b7f44a0e674c738920477f7741ad5743ace","author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"date":"2026-09-16 12:03:57.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"3b52f25968b0b37fed4d150af8ec7376f5cebb9f","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"date":"2026-09-16 12:06:22.000000000","message":"Uploaded patch set 3.","accounts_in_message":[],"_revision_number":3},{"id":"1ea6261f465b1952e9331e1f41d7fc3492e86c13","author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"date":"2026-09-16 12:15:14.000000000","message":"Patch Set 3: Code-Review+2","accounts_in_message":[],"_revision_number":3},{"id":"97f0841c70d10bd2f6e8a41306da7cb605016d8f","tag":"autogenerated:gerrit:merged","author":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"date":"2026-09-16 20:30:10.000000000","message":"Change has been successfully pushed.","accounts_in_message":[],"_revision_number":4}],"current_revision_number":4,"current_revision":"69e40fabd902321e8d30622094d6ea7bf9992db1","revisions":{"abf505b43e81379893327db19314920f5271556e":{"kind":"REWORK","_number":1,"created":"2026-07-02 11:41:18.000000000","uploader":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"ref":"refs/changes/66/1766/1","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/66/1766/1","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/1 \u0026\u0026 git checkout -b change-1766 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/66/1766/1","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/1 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"37160ee8408150990787eef4a76e0299230ed8d8","subject":"Update Changes.rst"}],"author":{"name":"Arne Schwabe","email":"arne@rfc2549.org","date":"2026-05-20 23:07:34.000000000","tz":0},"committer":{"name":"Arne Schwabe","email":"arne@rfc2549.org","date":"2026-07-02 11:41:07.000000000","tz":120},"subject":"Backport stricter check for valid tokens","message":"Backport stricter check for valid tokens\n\nThis also improves is_auth_token to check for the correct length and\nadds a few unit tests.\n\nOpenVPN 2.5 does not have the logic to keep a session id for the auth\ntoken. So it does not suffer the same problem that 2.6 and 2.7 did\n(CVE 2026-13122).\n\nHowever the improvement that we are a lot stricter to check what might\nbe an auth token is a good thing to backport as well to avoid any other\npotential issues that might be there.\n\nPartial cherry pick from ee119b24b3.\n\nChange-Id: I16187153e5b107eb08ccb7c9c9ed4acd6377af0c\nSigned-off-by: Arne Schwabe \u003carne@rfc2549.org\u003e\n"},"branch":"refs/heads/release/2.5"},"a910137b2e1847e47fe1bdb82df13814f07ce7a8":{"kind":"REWORK","_number":2,"created":"2026-09-16 12:01:40.000000000","uploader":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"ref":"refs/changes/66/1766/2","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/66/1766/2","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/2 \u0026\u0026 git checkout -b change-1766 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/66/1766/2","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/2 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"37160ee8408150990787eef4a76e0299230ed8d8","subject":"Update Changes.rst"}],"author":{"name":"Arne Schwabe","email":"arne@rfc2549.org","date":"2026-05-20 23:07:34.000000000","tz":0},"committer":{"name":"Arne Schwabe","email":"arne@rfc2549.org","date":"2026-09-16 12:01:24.000000000","tz":120},"subject":"Backport stricter check for valid tokens","message":"Backport stricter check for valid tokens\n\nOpenVPN 2.5 does not have the logic to keep a session id for the auth\ntoken. So it does not suffer the same problem that 2.6 and 2.7 did\n(CVE 2026-13122).\n\nHowever the improvement that we are a lot stricter to check what might\nbe an auth token is a good thing to backport as well to avoid any other\npotential issues that might be there.\n\nPartial cherry pick from ee119b24b3. This drops the parts that are not\npresent in 2.5 and also forgoes back porting the new unit tests.\n\nChange-Id: I16187153e5b107eb08ccb7c9c9ed4acd6377af0c\nSigned-off-by: Arne Schwabe \u003carne@rfc2549.org\u003e\n"},"branch":"refs/heads/release/2.5"},"8f83012ce38ef3afa7a1335f301b503c101e5ec8":{"kind":"REWORK","_number":3,"created":"2026-09-16 12:06:22.000000000","uploader":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"ref":"refs/changes/66/1766/3","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/66/1766/3","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/3 \u0026\u0026 git checkout -b change-1766 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/66/1766/3","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/3 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"37160ee8408150990787eef4a76e0299230ed8d8","subject":"Update Changes.rst"}],"author":{"name":"Arne Schwabe","email":"arne@rfc2549.org","date":"2026-05-20 23:07:34.000000000","tz":0},"committer":{"name":"Arne Schwabe","email":"arne@rfc2549.org","date":"2026-09-16 12:06:11.000000000","tz":120},"subject":"Backport stricter check for valid tokens","message":"Backport stricter check for valid tokens\n\nOpenVPN 2.5 does not have the logic to keep a session id for the auth\ntoken. So it does not suffer the same problem that 2.6 and 2.7 did\n(CVE 2026-13122).\n\nHowever the improvement that we are a lot stricter to check what might\nbe an auth token is a good thing to backport as well to avoid any other\npotential issues that might be there.\n\nPartial cherry pick from ee119b24b3. This drops the parts that are not\npresent in 2.5 and also forgoes back porting the new unit tests.\n\nChange-Id: I16187153e5b107eb08ccb7c9c9ed4acd6377af0c\nSigned-off-by: Arne Schwabe \u003carne@rfc2549.org\u003e\n"},"branch":"refs/heads/release/2.5"},"69e40fabd902321e8d30622094d6ea7bf9992db1":{"kind":"REWORK","_number":4,"created":"2026-09-16 20:30:10.000000000","uploader":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"ref":"refs/changes/66/1766/4","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/66/1766/4","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/4 \u0026\u0026 git checkout -b change-1766 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/66/1766/4","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/66/1766/4 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"68e18e528197733663ab84fb3b70d7dba7732f24","subject":"interactive: forbid \"--setenv opt\" in startup data"}],"author":{"name":"Arne Schwabe","email":"arne@rfc2549.org","date":"2026-09-16 16:46:43.000000000","tz":120},"committer":{"name":"Gert Doering","email":"gert@greenie.muc.de","date":"2026-09-16 18:31:06.000000000","tz":120},"subject":"Backport stricter check for valid tokens","message":"Backport stricter check for valid tokens\n\nOpenVPN 2.5 does not have the logic to keep a session id for the auth\ntoken. So it does not suffer the same problem that 2.6 and 2.7 did\n(CVE 2026-13122).\n\nHowever the improvement that we are a lot stricter to check what might\nbe an auth token is a good thing to backport as well to avoid any other\npotential issues that might be there.\n\nPartial cherry pick from ee119b24b3. This drops the parts that are not\npresent in 2.5 and also forgoes back porting the new unit tests.\n\nChange-Id: I16187153e5b107eb08ccb7c9c9ed4acd6377af0c\nSigned-off-by: Arne Schwabe \u003carne@rfc2549.org\u003e\nAcked-by: Razvan Cojocaru \u003crazvanc@mailbox.org\u003e\nGerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1766\nMessage-Id: \u003c20260916164648.31293-1-gert@greenie.muc.de\u003e\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg39256.html\nSigned-off-by: Gert Doering \u003cgert@greenie.muc.de\u003e\n"},"branch":"refs/heads/release/2.5"}},"requirements":[],"submit_records":[]}