)]}'
{"id":"openvpn~1889","triplet_id":"openvpn~master~I787a7067f6ff040c6a1f43f384321bddf5efc97b","project":"openvpn","branch":"master","full_branch":"refs/heads/master","attention_set":{},"removed_from_attention_set":{"1000006":{"account":{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@openvpn.net","username":"d12fk"},"last_update":"2026-09-02 07:23:08.000000000","reason":"Change was submitted"},"1000003":{"account":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"last_update":"2026-09-02 07:23:08.000000000","reason":"Change was submitted"},"1000002":{"account":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"last_update":"2026-09-02 07:23:08.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"I787a7067f6ff040c6a1f43f384321bddf5efc97b","subject":"win: don\u0027t use NULL DACL with system objects","status":"MERGED","created":"2026-09-01 17:06:12.000000000","updated":"2026-09-02 07:23:08.000000000","submitted":"2026-09-02 07:23:08.000000000","submitter":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1889","meta_rev_id":"4cb710f5c8210ad263509063cdbdabb663ca4abf","_number":1889,"virtual_id_number":1889,"owner":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"actions":{},"labels":{"Code-Review":{"all":[{"value":0,"_account_id":1000008,"name":"Lev Stipakov","display_name":"Lev Stipakov","email":"lstipakov@gmail.com","username":"stipa"},{"value":0,"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"}],"values":{"-2":"This shall not be submitted","-1":"I would prefer this is not submitted as is"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me, approved"},"description":"","default_value":0}},"removable_reviewers":[{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"}],"reviewers":{"REVIEWER":[{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},{"_account_id":1000008,"name":"Lev Stipakov","display_name":"Lev Stipakov","email":"lstipakov@gmail.com","username":"stipa"}],"CC":[{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@openvpn.net","username":"d12fk"},{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-09-01 17:06:12.000000000","updated_by":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"real_updated_by":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"reviewer":{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@openvpn.net","username":"d12fk"},"state":"REVIEWER"},{"updated":"2026-09-01 17:06:13.000000000","updated_by":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"real_updated_by":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"reviewer":{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"},"state":"CC"},{"updated":"2026-09-01 17:06:13.000000000","updated_by":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"real_updated_by":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"reviewer":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"state":"REVIEWER"},{"updated":"2026-09-01 19:10:34.000000000","updated_by":{"_account_id":1000008,"name":"Lev Stipakov","display_name":"Lev Stipakov","email":"lstipakov@gmail.com","username":"stipa"},"real_updated_by":{"_account_id":1000008,"name":"Lev Stipakov","display_name":"Lev Stipakov","email":"lstipakov@gmail.com","username":"stipa"},"reviewer":{"_account_id":1000008,"name":"Lev Stipakov","display_name":"Lev Stipakov","email":"lstipakov@gmail.com","username":"stipa"},"state":"REVIEWER"},{"updated":"2026-09-02 07:23:08.000000000","updated_by":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"real_updated_by":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"reviewer":{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@openvpn.net","username":"d12fk"},"state":"CC"}],"messages":[{"id":"6b02a8cb80c0f12f3b88bd20cc72385678adac4b","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"date":"2026-09-01 17:06:12.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"60e28449c9cb88c8220e9387c528dd485fbf2f46","author":{"_account_id":1000008,"name":"Lev Stipakov","display_name":"Lev Stipakov","email":"lstipakov@gmail.com","username":"stipa"},"date":"2026-09-01 19:10:34.000000000","message":"Patch Set 1: Code-Review+2\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"4cb710f5c8210ad263509063cdbdabb663ca4abf","tag":"autogenerated:gerrit:merged","author":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"date":"2026-09-02 07:23:08.000000000","message":"Change has been successfully pushed.","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"23396ac49bdd390d2e559e74fec16e8763650b78","revisions":{"395f0a0e0661e4acc76432a71735c45d5cd657a2":{"kind":"REWORK","_number":1,"created":"2026-09-01 17:06:12.000000000","uploader":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"ref":"refs/changes/89/1889/1","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/89/1889/1","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/89/1889/1 \u0026\u0026 git checkout -b change-1889 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/89/1889/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/89/1889/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/89/1889/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/89/1889/1","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/89/1889/1 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"90ab7be00e73d06f7a5bf72e6a454fcfd5f2818c","subject":"networking_sitnl: validate netlink replies against the request"}],"author":{"name":"Heiko Hund","email":"heiko@ist.eigentlich.net","date":"2026-08-25 00:12:53.000000000","tz":120},"committer":{"name":"Gert Doering","email":"gert@greenie.muc.de","date":"2026-09-01 17:03:33.000000000","tz":120},"subject":"win: don\u0027t use NULL DACL with system objects","message":"win: don\u0027t use NULL DACL with system objects\n\nThe netsh semaphore used a NULL DACL, which allowed any user on a shared\nsystem to block openvpn from running. Instances would time out and shut\ndown.\n\nSimilar with the --service exit event. Any user could signal it and shut\ndown the instance if the event name is known or can be retrieved from\nthe running process.\n\nTo prevent both, the objects are created with a DACL which allows access\nto the creating user only. In case of the netsh semaphore this means that\nonly the first user running openvpn can run more instances. Other\naccounts doing so will error out. The interactive service can be used to\nprevent this from happening, since the netsh semaphore is only used when\nthe openvpn process runs privileged operations directly.\n\nGithub: OpenVPN/openvpn-private-issues#167\nCVE: 2026-82312\nReported-By: DEBRAJ BASAK \u003chttps://in.linkedin.com/in/debrajbasak\u003e\nChange-Id: I787a7067f6ff040c6a1f43f384321bddf5efc97b\nSigned-off-by: Heiko Hund \u003cheiko@ist.eigentlich.net\u003e\n"},"branch":"refs/heads/master"},"23396ac49bdd390d2e559e74fec16e8763650b78":{"kind":"NO_CODE_CHANGE","_number":2,"created":"2026-09-02 07:23:08.000000000","uploader":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"ref":"refs/changes/89/1889/2","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/89/1889/2","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/89/1889/2 \u0026\u0026 git checkout -b change-1889 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/89/1889/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/89/1889/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/89/1889/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/89/1889/2","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/89/1889/2 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"90ab7be00e73d06f7a5bf72e6a454fcfd5f2818c","subject":"networking_sitnl: validate netlink replies against the request"}],"author":{"name":"Heiko Hund","email":"heiko@ist.eigentlich.net","date":"2026-09-01 20:28:49.000000000","tz":120},"committer":{"name":"Gert Doering","email":"gert@greenie.muc.de","date":"2026-09-02 06:45:13.000000000","tz":120},"subject":"win: don\u0027t use NULL DACL with system objects","message":"win: don\u0027t use NULL DACL with system objects\n\nThe netsh semaphore used a NULL DACL, which allowed any user on a shared\nsystem to block openvpn from running. Instances would time out and shut\ndown.\n\nSimilar with the --service exit event. Any user could signal it and shut\ndown the instance if the event name is known or can be retrieved from\nthe running process.\n\nTo prevent both, the objects are created with a DACL which allows access\nto the creating user only. In case of the netsh semaphore this means that\nonly the first user running openvpn can run more instances. Other\naccounts doing so will error out. The interactive service can be used to\nprevent this from happening, since the netsh semaphore is only used when\nthe openvpn process runs privileged operations directly.\n\nGithub: OpenVPN/openvpn-private-issues#167\nCVE: 2026-82312\nReported-By: DEBRAJ BASAK \u003chttps://in.linkedin.com/in/debrajbasak\u003e\nChange-Id: I787a7067f6ff040c6a1f43f384321bddf5efc97b\nSigned-off-by: Heiko Hund \u003cheiko@ist.eigentlich.net\u003e\nAcked-by: Lev Stipakov \u003clstipakov@gmail.com\u003e\nGerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1889\nMessage-Id: \u003c20260901202854.13746-1-gert@greenie.muc.de\u003e\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg38886.html\nSigned-off-by: Gert Doering \u003cgert@greenie.muc.de\u003e\n"},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[]}