)]}'
{"id":"openvpn~1883","triplet_id":"openvpn~release%2F2.6~Ica5d43989b441d4377a3908f811a2953b7a9d45a","project":"openvpn","branch":"release/2.6","attention_set":{},"removed_from_attention_set":{"1000003":{"account":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"last_update":"2026-08-31 06:47:39.000000000","reason":"Change was submitted"},"1000002":{"account":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"last_update":"2026-08-31 06:47:39.000000000","reason":"Change was submitted"},"1000006":{"account":{"_account_id":1000006,"name":"d12fk","display_name":"Heiko Hund","email":"heiko@openvpn.net","username":"d12fk"},"last_update":"2026-08-31 06:47:39.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"Ica5d43989b441d4377a3908f811a2953b7a9d45a","subject":"openvpnserv: detect sibling dirs in CheckConfigPath","status":"MERGED","created":"2026-08-30 18:12:17.000000000","updated":"2026-08-31 06:47:39.000000000","submitted":"2026-08-31 06:47:39.000000000","submitter":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1883","meta_rev_id":"3cf5de835d0e0224bc6fe344a154e2e72e31b330","_number":1883,"virtual_id_number":1883,"owner":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"actions":{},"labels":{"Code-Review":{"all":[{"value":0,"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},{"value":0,"_account_id":1000053,"name":"razvanc","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"}],"values":{"-2":"This shall not be submitted","-1":"I would prefer this is not submitted as is"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me, approved"},"description":"","default_value":0}},"removable_reviewers":[{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"}],"reviewers":{"REVIEWER":[{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},{"_account_id":1000053,"name":"razvanc","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"}],"CC":[{"_account_id":1000006,"name":"d12fk","display_name":"Heiko Hund","email":"heiko@openvpn.net","username":"d12fk"},{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-30 18:12:17.000000000","updated_by":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"reviewer":{"_account_id":1000006,"name":"d12fk","display_name":"Heiko Hund","email":"heiko@openvpn.net","username":"d12fk"},"state":"REVIEWER"},{"updated":"2026-08-30 18:12:18.000000000","updated_by":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"reviewer":{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"},"state":"CC"},{"updated":"2026-08-30 18:12:18.000000000","updated_by":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"reviewer":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"state":"REVIEWER"},{"updated":"2026-08-30 18:16:37.000000000","updated_by":{"_account_id":1000053,"name":"razvanc","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"reviewer":{"_account_id":1000053,"name":"razvanc","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"state":"REVIEWER"},{"updated":"2026-08-31 06:47:39.000000000","updated_by":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"reviewer":{"_account_id":1000006,"name":"d12fk","display_name":"Heiko Hund","email":"heiko@openvpn.net","username":"d12fk"},"state":"CC"}],"messages":[{"id":"d3b5749394c3420cb6051d1aa0271b65a5a68434","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"date":"2026-08-30 18:12:17.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"781f1bbd91aba902d1ea768eb114ae05aeda4c63","author":{"_account_id":1000053,"name":"razvanc","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"date":"2026-08-30 18:16:37.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"3cf5de835d0e0224bc6fe344a154e2e72e31b330","tag":"autogenerated:gerrit:merged","author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"date":"2026-08-31 06:47:39.000000000","message":"Change has been successfully pushed.","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"927b18dff00a8ec0e9233a9689569e4519fc7de6","revisions":{"5df16c3a170e08f59f94b7c36b73d5c84883148f":{"kind":"REWORK","_number":1,"created":"2026-08-30 18:12:17.000000000","uploader":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"ref":"refs/changes/83/1883/1","fetch":{"anonymous http":{"url":"http://gerrit.openvpn.net/openvpn","ref":"refs/changes/83/1883/1","commands":{"Branch":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/83/1883/1 \u0026\u0026 git checkout -b change-1883 FETCH_HEAD","Checkout":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/83/1883/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/83/1883/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/83/1883/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull http://gerrit.openvpn.net/openvpn refs/changes/83/1883/1","Reset To":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/83/1883/1 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"c9b790f5b9e8ebca5da38c22f479c31bb8d33686","subject":"OpenVPN Release 2.6.22"}],"author":{"name":"Heiko Hund","email":"heiko@ist.eigentlich.net","date":"2026-08-23 21:50:24.000000000","tz":120},"committer":{"name":"Gert Doering","email":"gert@greenie.muc.de","date":"2026-08-30 18:10:55.000000000","tz":120},"subject":"openvpnserv: detect sibling dirs in CheckConfigPath","message":"openvpnserv: detect sibling dirs in CheckConfigPath\n\nIf the config_dir value in the registry has no trailing backslash the\ncheck doesn\u0027t actually guarantee that a file is located within\nconfig_dir, because a sibling dir with the same prefix, e.g. \u0027config\u0027\nand \u0027config-evil\u0027 will match and produce a positive verdict.\n\nBy also checking that there is a path separator after config_dir\nprevents this attack.\n\nReported-By: Harshit Varu \u003charshitvaru666@gmail.com\u003e\nTested-By: Harshit Varu \u003charshitvaru666@gmail.com\u003e\nCVE: 2026-81830\nGithub: OpenVPN/openvpn-private-issues#166\nChange-Id: Ica5d43989b441d4377a3908f811a2953b7a9d45a\nSigned-off-by: Heiko Hund \u003cheiko@ist.eigentlich.net\u003e\n"},"branch":"refs/heads/release/2.6"},"927b18dff00a8ec0e9233a9689569e4519fc7de6":{"kind":"NO_CODE_CHANGE","_number":2,"created":"2026-08-31 06:47:39.000000000","uploader":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"ref":"refs/changes/83/1883/2","fetch":{"anonymous http":{"url":"http://gerrit.openvpn.net/openvpn","ref":"refs/changes/83/1883/2","commands":{"Branch":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/83/1883/2 \u0026\u0026 git checkout -b change-1883 FETCH_HEAD","Checkout":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/83/1883/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/83/1883/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/83/1883/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull http://gerrit.openvpn.net/openvpn refs/changes/83/1883/2","Reset To":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/83/1883/2 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"c9b790f5b9e8ebca5da38c22f479c31bb8d33686","subject":"OpenVPN Release 2.6.22"}],"author":{"name":"Heiko Hund","email":"heiko@ist.eigentlich.net","date":"2026-08-30 18:21:27.000000000","tz":120},"committer":{"name":"Gert Doering","email":"gert@greenie.muc.de","date":"2026-08-31 06:43:01.000000000","tz":120},"subject":"openvpnserv: detect sibling dirs in CheckConfigPath","message":"openvpnserv: detect sibling dirs in CheckConfigPath\n\nIf the config_dir value in the registry has no trailing backslash the\ncheck doesn\u0027t actually guarantee that a file is located within\nconfig_dir, because a sibling dir with the same prefix, e.g. \u0027config\u0027\nand \u0027config-evil\u0027 will match and produce a positive verdict.\n\nBy also checking that there is a path separator after config_dir\nprevents this attack.\n\nReported-By: Harshit Varu \u003charshitvaru666@gmail.com\u003e\nTested-By: Harshit Varu \u003charshitvaru666@gmail.com\u003e\nCVE: 2026-81830\nGithub: OpenVPN/openvpn-private-issues#166\nChange-Id: Ica5d43989b441d4377a3908f811a2953b7a9d45a\nSigned-off-by: Heiko Hund \u003cheiko@ist.eigentlich.net\u003e\nAcked-by: Razvan Cojocaru \u003crazvanc@mailbox.org\u003e\nAcked-by: Arne Schwabe \u003carne@rfc2549.org\u003e\nGerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1883\nMessage-Id: \u003c20260830182134.32251-1-gert@greenie.muc.de\u003e\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg38828.html\nSigned-off-by: Gert Doering \u003cgert@greenie.muc.de\u003e\n"},"branch":"refs/heads/release/2.6"}},"requirements":[],"submit_records":[],"submit_requirements":[]}