)]}'
{"id":"openvpn~1898","triplet_id":"openvpn~master~Ic334518048d6ca57a504257e210467f9c451d268","project":"openvpn","branch":"master","full_branch":"refs/heads/master","attention_set":{},"removed_from_attention_set":{"1000030":{"account":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"last_update":"2026-09-07 12:24:36.000000000","reason":"Change was submitted"},"1000003":{"account":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"last_update":"2026-09-07 12:24:36.000000000","reason":"Change was submitted"},"1000035":{"account":{"_account_id":1000035,"name":"Steffan Karger","display_name":"Steffan Karger","email":"steffan@karger.me","username":"syzzer","status":"Commits and comments are my own views, not those of my employer."},"last_update":"2026-09-07 10:05:48.000000000","reason":"removed on reply"},"1000002":{"account":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"last_update":"2026-09-07 12:24:36.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"Ic334518048d6ca57a504257e210467f9c451d268","subject":"Check for \\0 and RFC 2253 chars in cert subjects","status":"MERGED","created":"2026-09-04 11:01:23.000000000","updated":"2026-09-07 12:24:36.000000000","submitted":"2026-09-07 12:24:36.000000000","submitter":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"total_comment_count":4,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1898","meta_rev_id":"5ca00630047fb678ffa6cfc723271473ed620b96","_number":1898,"virtual_id_number":1898,"owner":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"actions":{},"labels":{"Code-Review":{"all":[{"value":0,"_account_id":1000035,"name":"Steffan Karger","display_name":"Steffan Karger","email":"steffan@karger.me","username":"syzzer","status":"Commits and comments are my own views, not those of my employer."},{"value":0,"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"}],"values":{"-2":"This shall not be submitted","-1":"I would prefer this is not submitted as is"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me, approved"},"description":"","default_value":0}},"removable_reviewers":[{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"}],"reviewers":{"REVIEWER":[{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},{"_account_id":1000035,"name":"Steffan Karger","display_name":"Steffan Karger","email":"steffan@karger.me","username":"syzzer","status":"Commits and comments are my own views, not those of my employer."}],"CC":[{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-09-04 11:01:24.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"},"state":"CC"},{"updated":"2026-09-04 11:01:24.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"state":"REVIEWER"},{"updated":"2026-09-04 12:29:12.000000000","updated_by":{"_account_id":1000035,"name":"Steffan Karger","display_name":"Steffan Karger","email":"steffan@karger.me","username":"syzzer","status":"Commits and comments are my own views, not those of my employer."},"real_updated_by":{"_account_id":1000035,"name":"Steffan Karger","display_name":"Steffan Karger","email":"steffan@karger.me","username":"syzzer","status":"Commits and comments are my own views, not those of my employer."},"reviewer":{"_account_id":1000035,"name":"Steffan Karger","display_name":"Steffan Karger","email":"steffan@karger.me","username":"syzzer","status":"Commits and comments are my own views, not those of my employer."},"state":"REVIEWER"},{"updated":"2026-09-06 08:43:19.000000000","updated_by":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"real_updated_by":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"reviewer":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"state":"REVIEWER"}],"messages":[{"id":"fc3ef016121665d0003befb3b0bd16d5da4637d3","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"date":"2026-09-04 11:01:23.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"1e247bd78f3827427bc2ed4bdcfd8e6009b68e10","author":{"_account_id":1000035,"name":"Steffan Karger","display_name":"Steffan Karger","email":"steffan@karger.me","username":"syzzer","status":"Commits and comments are my own views, not those of my employer."},"date":"2026-09-04 12:29:12.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"a3075178186af1802b86b59510e046c0957efc38","author":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"date":"2026-09-06 08:43:19.000000000","message":"Patch Set 1: Code-Review-1\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"08bf10835dcc75c1abc7b66883c36d0a50039700","author":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"date":"2026-09-06 17:35:53.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"bacdf7314dfbfa8384534ab3c65d3435e4aac2cd","author":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"date":"2026-09-06 18:24:23.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"d2bbc13c6e2ff397ba4de614c72f78b16105d5bb","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"date":"2026-09-07 09:06:30.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Code-Review+2, Code-Review-1 (copy condition: \"changekind:NO_CHANGE OR changekind:TRIVIAL_REBASE OR is:MIN\")\n","accounts_in_message":[],"_revision_number":2},{"id":"5acb68273e2aa51859fe91661949262faea88c68","author":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"date":"2026-09-07 09:07:59.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"d9872b9380cb25d37a29c2cb51c1ac11daa00c7d","author":{"_account_id":1000035,"name":"Steffan Karger","display_name":"Steffan Karger","email":"steffan@karger.me","username":"syzzer","status":"Commits and comments are my own views, not those of my employer."},"date":"2026-09-07 10:05:48.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"5ca00630047fb678ffa6cfc723271473ed620b96","tag":"autogenerated:gerrit:merged","author":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"date":"2026-09-07 12:24:36.000000000","message":"Change has been successfully pushed.","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"22a24132da88b6be9f121e4c6e74c18a46e7741f","revisions":{"eda13e5920b005cb50abb11bf776bb8e7cc32fe7":{"kind":"REWORK","_number":1,"created":"2026-09-04 11:01:23.000000000","uploader":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"ref":"refs/changes/98/1898/1","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/98/1898/1","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/98/1898/1 \u0026\u0026 git checkout -b change-1898 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/98/1898/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/98/1898/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/98/1898/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/98/1898/1","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/98/1898/1 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"01c8c4c624a7a1405c9afba8ad8d296dee595ee5","subject":"multi: don\u0027t let stale-routes-check delete permanent routes"}],"author":{"name":"Max Fillinger","email":"maximilian.fillinger@sentyron.com","date":"2026-08-27 18:43:38.000000000","tz":120},"committer":{"name":"Max Fillinger","email":"maximilian.fillinger@sentyron.com","date":"2026-09-04 10:53:18.000000000","tz":120},"subject":"Check for null-bytes in certificate subjects","message":"Check for null-bytes in certificate subjects\n\nWhen using the OpenSSL library, we escaped embedded null-bytes in a\ncertificate\u0027s subject in x509_get_subject(), but in\nextract_x509_field_ssl(), we copied any null-bytes that are contained in\nthe field value. When using the option --verify-x509-name, this could\nlead to an incorrect name being accepted. For example, the common name\n\"admin\\0impersonator\" would be accepted when running with\n--verify-x509-name admin name.\n\nTo fix this, this commit makes x509_get_subject() return an error if the\nsubject contains an embedded null-byte. This way, OpenVPN won\u0027t connect\nwith peers that present such certificates.\n\nAs a defense-in-depth measure, we also check for null-bytes in\nextract_x509_field_ssl() in case a future version of OpenVPN has a code\npath that avoids x509_get_subject().\n\nAdditionally, we also escape characters in the subject that would make\nparsing of the resulting string ambiguous. For example, if the Common\nName is \"name, O\u003dInjectedOrg\", and the Organization is \"RealOrg\",\nthis will now be converted to \"CN\u003dname\\, O\u003dInjectedOrg, O\u003dRealOrg\" to\nmake it clear which \"O\" field is legitimate.\n\nWith Mbed TLS, the x509_get_subject() function already returned an error\nwhen there is an embedded null-byte. (As of Mbed TLS 3.5.) Here too, we\nadded a check for null-bytes to the function where we extract individual\nfields from the subject.\n\nAlso, backend_x509_get_username() is changed so that it returns the\nvalue of the *last* matching field, to be consistent with the behavior\nof the OpenSSL backend.\n\nWe decided to publish this commit without embargo even though it fixes a\nCVE, because exploiting it requires a malicious or very negligent CA.\n\nDiscovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2.\nContributing Researcher: Vivek Parikh.\n\nCVE: 2026-84790\nReported-by: Vivek Parikh \u003cvivek.parikh@breachx.ai\u003e\nGithub: OpenVPN/openvpn-private-issues#163\n\nChange-Id: Ic334518048d6ca57a504257e210467f9c451d268\nSigned-off-by: Max Fillinger \u003cmaximilian.fillinger@sentyron.com\u003e\n"},"branch":"refs/heads/master"},"590a76643df65c4fc73a696a83d58b90ded32af7":{"kind":"REWORK","_number":2,"created":"2026-09-07 09:06:30.000000000","uploader":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"ref":"refs/changes/98/1898/2","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/98/1898/2","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/98/1898/2 \u0026\u0026 git checkout -b change-1898 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/98/1898/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/98/1898/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/98/1898/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/98/1898/2","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/98/1898/2 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"01c8c4c624a7a1405c9afba8ad8d296dee595ee5","subject":"multi: don\u0027t let stale-routes-check delete permanent routes"}],"author":{"name":"Max Fillinger","email":"maximilian.fillinger@sentyron.com","date":"2026-08-27 18:43:38.000000000","tz":120},"committer":{"name":"Max Fillinger","email":"maximilian.fillinger@sentyron.com","date":"2026-09-07 08:59:46.000000000","tz":120},"subject":"Check for \\0 and RFC 2253 chars in cert subjects","message":"Check for \\0 and RFC 2253 chars in cert subjects\n\nWhen using the OpenSSL library, we escaped embedded null-bytes in a\ncertificate\u0027s subject in x509_get_subject(), but in\nextract_x509_field_ssl(), we copied any null-bytes that are contained in\nthe field value. When using the option --verify-x509-name, this could\nlead to an incorrect name being accepted. For example, the common name\n\"admin\\0impersonator\" would be accepted when running with\n--verify-x509-name admin name.\n\nTo fix this, this commit makes x509_get_subject() return an error if the\nsubject contains an embedded null-byte. This way, OpenVPN won\u0027t connect\nwith peers that present such certificates.\n\nAs a defense-in-depth measure, we also check for null-bytes in\nextract_x509_field_ssl() in case a future version of OpenVPN has a code\npath that avoids x509_get_subject().\n\nAdditionally, we escape RFC 2253 characters in the subject that would\nmake parsing of the resulting string ambiguous. For example, if the\nCommon Name is \"name, O\u003dInjectedOrg\", and the Organization is \"RealOrg\",\nthis will now be converted to \"CN\u003dname\\, O\u003dInjectedOrg, O\u003dRealOrg\" to\nmake it clear which \"O\" field is legitimate.\n\nWith Mbed TLS, the x509_get_subject() function already returned an error\nwhen there is an embedded null-byte. (As of Mbed TLS 3.5.) Here too, we\nadded a check for null-bytes to the function where we extract individual\nfields from the subject.\n\nAlso, backend_x509_get_username() is changed so that it returns the\nvalue of the *last* matching field, to be consistent with the behavior\nof the OpenSSL backend.\n\nDiscovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2.\nContributing Researcher: Vivek Parikh.\n\nCVE: 2026-84790\nReported-by: Vivek Parikh \u003cvivek.parikh@breachx.ai\u003e\nGithub: OpenVPN/openvpn-private-issues#163\n\nChange-Id: Ic334518048d6ca57a504257e210467f9c451d268\nSigned-off-by: Max Fillinger \u003cmaximilian.fillinger@sentyron.com\u003e\n"},"branch":"refs/heads/master"},"22a24132da88b6be9f121e4c6e74c18a46e7741f":{"kind":"TRIVIAL_REBASE_WITH_MESSAGE_UPDATE","_number":3,"created":"2026-09-07 12:24:36.000000000","uploader":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"ref":"refs/changes/98/1898/3","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/98/1898/3","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/98/1898/3 \u0026\u0026 git checkout -b change-1898 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/98/1898/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/98/1898/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/98/1898/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/98/1898/3","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/98/1898/3 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"96f059ccfb16f051513b59314b7b3631d4fe7dae","subject":"test_schedule: Make all the counting variables unsigned"}],"author":{"name":"Max Fillinger","email":"maximilian.fillinger@sentyron.com","date":"2026-09-07 10:09:41.000000000","tz":120},"committer":{"name":"Gert Doering","email":"gert@greenie.muc.de","date":"2026-09-07 12:22:41.000000000","tz":120},"subject":"Check for \\0 and RFC 2253 chars in cert subjects","message":"Check for \\0 and RFC 2253 chars in cert subjects\n\nWhen using the OpenSSL library, we escaped embedded null-bytes in a\ncertificate\u0027s subject in x509_get_subject(), but in\nextract_x509_field_ssl(), we copied any null-bytes that are contained in\nthe field value. When using the option --verify-x509-name, this could\nlead to an incorrect name being accepted. For example, the common name\n\"admin\\0impersonator\" would be accepted when running with\n--verify-x509-name admin name.\n\nTo fix this, this commit makes x509_get_subject() return an error if the\nsubject contains an embedded null-byte. This way, OpenVPN won\u0027t connect\nwith peers that present such certificates.\n\nAs a defense-in-depth measure, we also check for null-bytes in\nextract_x509_field_ssl() in case a future version of OpenVPN has a code\npath that avoids x509_get_subject().\n\nAdditionally, we escape RFC 2253 characters in the subject that would\nmake parsing of the resulting string ambiguous. For example, if the\nCommon Name is \"name, O\u003dInjectedOrg\", and the Organization is \"RealOrg\",\nthis will now be converted to \"CN\u003dname\\, O\u003dInjectedOrg, O\u003dRealOrg\" to\nmake it clear which \"O\" field is legitimate.\n\nWith Mbed TLS, the x509_get_subject() function already returned an error\nwhen there is an embedded null-byte. (As of Mbed TLS 3.5.) Here too, we\nadded a check for null-bytes to the function where we extract individual\nfields from the subject.\n\nAlso, backend_x509_get_username() is changed so that it returns the\nvalue of the *last* matching field, to be consistent with the behavior\nof the OpenSSL backend.\n\nDiscovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2.\nContributing Researcher: Vivek Parikh.\n\nCVE: 2026-84790\nReported-by: Vivek Parikh \u003cvivek.parikh@breachx.ai\u003e\nGithub: OpenVPN/openvpn-private-issues#163\n\nChange-Id: Ic334518048d6ca57a504257e210467f9c451d268\nSigned-off-by: Max Fillinger \u003cmaximilian.fillinger@sentyron.com\u003e\nAcked-by: Steffan Karger \u003csteffan@karger.me\u003e\nGerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1898\nMessage-Id: \u003c20260907100947.25255-1-gert@greenie.muc.de\u003e\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg38973.html\nSigned-off-by: Gert Doering \u003cgert@greenie.muc.de\u003e\n"},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[]}