)]}'
{"id":"openvpn~1906","triplet_id":"openvpn~release%2F2.6~I371aafba18d336bcfd3912e92c18301e39bf6087","project":"openvpn","branch":"release/2.6","full_branch":"refs/heads/release/2.6","attention_set":{},"removed_from_attention_set":{"1000030":{"account":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"last_update":"2026-11-05 13:48:14.000000000","reason":"Change was abandoned"},"1000006":{"account":{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@ist.eigentlich.net","username":"d12fk"},"last_update":"2026-09-09 16:53:32.000000000","reason":"\u003cGERRIT_ACCOUNT_1000006\u003e replied on the change","reason_account":{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@ist.eigentlich.net","username":"d12fk"}},"1000053":{"account":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"last_update":"2026-11-05 13:48:14.000000000","reason":"Change was abandoned"},"1000003":{"account":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"last_update":"2026-11-05 13:48:14.000000000","reason":"Change was abandoned"},"1000002":{"account":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"last_update":"2026-11-05 13:48:14.000000000","reason":"Change was abandoned"}},"hashtags":[],"change_id":"I371aafba18d336bcfd3912e92c18301e39bf6087","subject":"openvpnserv: don\u0027t allow \u0027/\u0027 in config paths","status":"ABANDONED","created":"2026-09-08 16:33:27.000000000","updated":"2026-11-05 13:48:14.000000000","total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"9f040df5acff90f244892a6a23a919bf06b77ea2","_number":1906,"virtual_id_number":1906,"owner":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"actions":{},"labels":{"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@ist.eigentlich.net","username":"d12fk"},{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"}],"values":{"-2":"This shall not be submitted","-1":"I would prefer this is not submitted as is"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me, approved"},"description":"","default_value":0}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@ist.eigentlich.net","username":"d12fk"},{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"}],"CC":[{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-09-08 16:33:27.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"state":"REVIEWER"},{"updated":"2026-09-08 16:33:27.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"state":"REVIEWER"},{"updated":"2026-09-08 16:33:27.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@ist.eigentlich.net","username":"d12fk"},"state":"REVIEWER"},{"updated":"2026-09-08 16:33:27.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"},"state":"CC"},{"updated":"2026-09-08 16:33:27.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"state":"REVIEWER"},{"updated":"2026-09-09 11:24:03.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@ist.eigentlich.net","username":"d12fk"},"state":"CC"},{"updated":"2026-09-09 13:25:18.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@ist.eigentlich.net","username":"d12fk"},"state":"REVIEWER"}],"messages":[{"id":"668974c370b46c265de492b212f56b99c2052c70","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"date":"2026-09-08 16:33:27.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"4a4db17547fd6b0d823db0bc23b3b8734df69dc8","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"date":"2026-09-09 11:24:03.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"ba23acc442c47c69f2c943f17a61f0adb3423bd2","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"date":"2026-09-09 13:25:18.000000000","message":"Uploaded patch set 3.","accounts_in_message":[],"_revision_number":3},{"id":"7890135920404a210948bfc207f397c83e10d736","author":{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@ist.eigentlich.net","username":"d12fk"},"date":"2026-09-09 16:53:32.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"9f040df5acff90f244892a6a23a919bf06b77ea2","tag":"autogenerated:gerrit:abandon","author":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"date":"2026-11-05 13:48:14.000000000","message":"Abandoned","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"c1013297930bac77f5d3c4e1ec1ff184870d8804","revisions":{"52b30ac13a15b1577d77ec0a5e9dd258a4cf7bb3":{"kind":"REWORK","_number":1,"created":"2026-09-08 16:33:27.000000000","uploader":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"ref":"refs/changes/06/1906/1","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/06/1906/1","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/06/1906/1 \u0026\u0026 git checkout -b change-1906 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/06/1906/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/06/1906/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/06/1906/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/06/1906/1","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/06/1906/1 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"83a0276cbe830f8e28fe239cef35a83bb75d1001","subject":"dhcp: Fix off-by-one in write_dhcp_search_str() temp buffer guard"}],"author":{"name":"Heiko Hund","email":"heiko@ist.eigentlich.net","date":"2026-08-31 18:46:50.000000000","tz":120},"committer":{"name":"Max Fillinger","email":"maximilian.fillinger@sentyron.com","date":"2026-09-08 14:36:18.000000000","tz":120},"subject":"openvpnserv: don\u0027t allow \u0027/\u0027 in config paths","message":"openvpnserv: don\u0027t allow \u0027/\u0027 in config paths\n\nDo not allow forward slashes in user provided config paths. The PathCch*\nfunctions do not treat them as path separators, leading to \"/../\" not\nbeing canonicalized. That, and the fact that Windows file APIs accept\nforward slashes leads to possible directory traversal.\n\nDiscovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2.\nContributing Researcher: Vivek Parikh.\n\nReported-by: Vivek Parikh \u003cvivek.parikh@breachx.ai\u003e\nTested-by: Vivek Parikh \u003cvivek.parikh@breachx.ai\u003e\nCVE: 2026-78043\nGithub: OpenVPN/openvpn-private-issues#162\nChange-Id: I371aafba18d336bcfd3912e92c18301e39bf6087\nSigned-off-by: Heiko Hund \u003cheiko@ist.eigentlich.net\u003e\nAcked-by: Razvan Cojocaru \u003crazvanc@mailbox.org\u003e\nGerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1885\nMessage-Id: \u003c20260831184657.3332-1-gert@greenie.muc.de\u003e\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg38855.html\nSigned-off-by: Gert Doering \u003cgert@greenie.muc.de\u003e\n(cherry picked from commit eecebd88a38ffe1571d1a259da87f611b7b08e9c)\n"},"branch":"refs/heads/release/2.6"},"8020802fd71ee3fd49711e7faffa3a138ef19fac":{"kind":"REWORK","_number":2,"created":"2026-09-09 11:24:03.000000000","uploader":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"ref":"refs/changes/06/1906/2","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/06/1906/2","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/06/1906/2 \u0026\u0026 git checkout -b change-1906 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/06/1906/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/06/1906/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/06/1906/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/06/1906/2","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/06/1906/2 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"7dae631514b331485505470bbb8bcc67fb881d8f","subject":"Move check_session_buf_not_used method into the method that free the buffer"}],"author":{"name":"Heiko Hund","email":"heiko@ist.eigentlich.net","date":"2026-08-31 18:46:50.000000000","tz":120},"committer":{"name":"Max Fillinger","email":"maximilian.fillinger@sentyron.com","date":"2026-09-09 11:21:25.000000000","tz":120},"subject":"openvpnserv: don\u0027t allow \u0027/\u0027 in config paths","message":"openvpnserv: don\u0027t allow \u0027/\u0027 in config paths\n\nDo not allow forward slashes in user provided config paths. The PathCch*\nfunctions do not treat them as path separators, leading to \"/../\" not\nbeing canonicalized. That, and the fact that Windows file APIs accept\nforward slashes leads to possible directory traversal.\n\nDiscovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2.\nContributing Researcher: Vivek Parikh.\n\nReported-by: Vivek Parikh \u003cvivek.parikh@breachx.ai\u003e\nTested-by: Vivek Parikh \u003cvivek.parikh@breachx.ai\u003e\nCVE: 2026-78043\nGithub: OpenVPN/openvpn-private-issues#162\nChange-Id: I371aafba18d336bcfd3912e92c18301e39bf6087\nSigned-off-by: Heiko Hund \u003cheiko@ist.eigentlich.net\u003e\nAcked-by: Razvan Cojocaru \u003crazvanc@mailbox.org\u003e\nGerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1885\nMessage-Id: \u003c20260831184657.3332-1-gert@greenie.muc.de\u003e\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg38855.html\nSigned-off-by: Gert Doering \u003cgert@greenie.muc.de\u003e\n(cherry picked from commit eecebd88a38ffe1571d1a259da87f611b7b08e9c)\n"},"branch":"refs/heads/release/2.6"},"c1013297930bac77f5d3c4e1ec1ff184870d8804":{"kind":"REWORK","_number":3,"created":"2026-09-09 13:25:18.000000000","uploader":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"ref":"refs/changes/06/1906/3","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/06/1906/3","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/06/1906/3 \u0026\u0026 git checkout -b change-1906 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/06/1906/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/06/1906/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/06/1906/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/06/1906/3","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/06/1906/3 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"7dae631514b331485505470bbb8bcc67fb881d8f","subject":"Move check_session_buf_not_used method into the method that free the buffer"}],"author":{"name":"Heiko Hund","email":"heiko@ist.eigentlich.net","date":"2026-08-31 18:46:50.000000000","tz":120},"committer":{"name":"Max Fillinger","email":"maximilian.fillinger@sentyron.com","date":"2026-09-09 13:18:06.000000000","tz":120},"subject":"openvpnserv: don\u0027t allow \u0027/\u0027 in config paths","message":"openvpnserv: don\u0027t allow \u0027/\u0027 in config paths\n\nDo not allow forward slashes in user provided config paths. The PathCch*\nfunctions do not treat them as path separators, leading to \"/../\" not\nbeing canonicalized. That, and the fact that Windows file APIs accept\nforward slashes leads to possible directory traversal.\n\nDiscovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2.\nContributing Researcher: Vivek Parikh.\n\nReported-by: Vivek Parikh \u003cvivek.parikh@breachx.ai\u003e\nTested-by: Vivek Parikh \u003cvivek.parikh@breachx.ai\u003e\nCVE: 2026-78043\nGithub: OpenVPN/openvpn-private-issues#162\nChange-Id: I371aafba18d336bcfd3912e92c18301e39bf6087\nSigned-off-by: Heiko Hund \u003cheiko@ist.eigentlich.net\u003e\nAcked-by: Razvan Cojocaru \u003crazvanc@mailbox.org\u003e\nGerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1885\nMessage-Id: \u003c20260831184657.3332-1-gert@greenie.muc.de\u003e\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg38855.html\nSigned-off-by: Gert Doering \u003cgert@greenie.muc.de\u003e\n(cherry picked from commit eecebd88a38ffe1571d1a259da87f611b7b08e9c)\n"},"branch":"refs/heads/release/2.6"}},"requirements":[],"submit_records":[]}