)]}'
{"id":"openvpn~1907","triplet_id":"openvpn~release%2F2.6~Ic983a3bf1ee8d4ef98f3883d5e5ddf234696a182","project":"openvpn","branch":"release/2.6","full_branch":"refs/heads/release/2.6","attention_set":{},"removed_from_attention_set":{"1000030":{"account":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"last_update":"2026-09-25 15:12:36.000000000","reason":"Change was abandoned"},"1000006":{"account":{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@ist.eigentlich.net","username":"d12fk"},"last_update":"2026-09-09 16:49:28.000000000","reason":"removed on reply"},"1000053":{"account":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"last_update":"2026-09-25 15:12:36.000000000","reason":"Change was abandoned"},"1000003":{"account":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"last_update":"2026-09-25 15:12:36.000000000","reason":"Change was abandoned"},"1000002":{"account":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"last_update":"2026-09-25 15:12:36.000000000","reason":"Change was abandoned"}},"hashtags":[],"change_id":"Ic983a3bf1ee8d4ef98f3883d5e5ddf234696a182","subject":"openvpnserv: harden CheckConfigPath() a bit more","status":"ABANDONED","created":"2026-09-08 16:34:00.000000000","updated":"2026-09-25 15:12:36.000000000","total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"eb0e385d56b5af80e862efd9d472d4461538ada5","_number":1907,"virtual_id_number":1907,"owner":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"actions":{},"labels":{"Code-Review":{"all":[{"value":0,"date":"2026-09-09 16:56:15.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@ist.eigentlich.net","username":"d12fk"},{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"}],"values":{"-2":"This shall not be submitted","-1":"I would prefer this is not submitted as is"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me, approved"},"description":"","default_value":0}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@ist.eigentlich.net","username":"d12fk"},{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"}],"CC":[{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-09-08 16:34:00.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"state":"REVIEWER"},{"updated":"2026-09-08 16:34:00.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"state":"REVIEWER"},{"updated":"2026-09-08 16:34:00.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"state":"REVIEWER"},{"updated":"2026-09-08 16:34:00.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@ist.eigentlich.net","username":"d12fk"},"state":"REVIEWER"},{"updated":"2026-09-08 16:34:01.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"},"state":"CC"},{"updated":"2026-09-09 11:24:58.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@ist.eigentlich.net","username":"d12fk"},"state":"CC"},{"updated":"2026-09-09 13:25:26.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@ist.eigentlich.net","username":"d12fk"},"state":"REVIEWER"}],"messages":[{"id":"15341a844bf813c1ea5468c25a753c2deb338b76","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"date":"2026-09-08 16:34:00.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"3cd6abfd2a167ee17f2a6ffa05485297726efb0d","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"date":"2026-09-09 11:24:58.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.","accounts_in_message":[],"_revision_number":2},{"id":"332e55e9273b447659bc09d9b555c3c612899d63","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"date":"2026-09-09 13:25:26.000000000","message":"Uploaded patch set 3.","accounts_in_message":[],"_revision_number":3},{"id":"2985e1527c6ee180312c53f5059ad1e8a25092d7","author":{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@ist.eigentlich.net","username":"d12fk"},"date":"2026-09-09 16:49:28.000000000","message":"Patch Set 3: Code-Review+2","accounts_in_message":[],"_revision_number":3},{"id":"c2b9c585d06ce63ac38e2df8f0f94f64d800663b","tag":"autogenerated:gerrit:deleteVote","author":{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@ist.eigentlich.net","username":"d12fk"},"date":"2026-09-09 16:55:27.000000000","message":"Removed Code-Review+2 by \u003cGERRIT_ACCOUNT_1000006\u003e\n","accounts_in_message":[{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@ist.eigentlich.net","username":"d12fk"}],"_revision_number":3},{"id":"448d048d957740fba661f997db545d61057c2124","author":{"_account_id":1000006,"name":"Heiko Hund","display_name":"Heiko Hund","email":"heiko@ist.eigentlich.net","username":"d12fk"},"date":"2026-09-09 16:56:15.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"eb0e385d56b5af80e862efd9d472d4461538ada5","tag":"autogenerated:gerrit:abandon","author":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"date":"2026-09-25 15:12:36.000000000","message":"Abandoned\n\nthe relevant check is already present in the 2.6 code base","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"a453210da741209545b1b6d026a6487151789341","revisions":{"6701dba01aa860e64db2c91d4974589921bbcc65":{"kind":"REWORK","_number":1,"created":"2026-09-08 16:34:00.000000000","uploader":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"ref":"refs/changes/07/1907/1","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/07/1907/1","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/07/1907/1 \u0026\u0026 git checkout -b change-1907 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/07/1907/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/07/1907/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/07/1907/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/07/1907/1","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/07/1907/1 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"52b30ac13a15b1577d77ec0a5e9dd258a4cf7bb3","subject":"openvpnserv: don\u0027t allow \u0027/\u0027 in config paths"}],"author":{"name":"Heiko Hund","email":"heiko@ist.eigentlich.net","date":"2026-08-31 18:47:04.000000000","tz":120},"committer":{"name":"Max Fillinger","email":"maximilian.fillinger@sentyron.com","date":"2026-09-08 15:15:53.000000000","tz":120},"subject":"openvpnserv: harden CheckConfigPath() a bit more","message":"openvpnserv: harden CheckConfigPath() a bit more\n\nIf the config_path retrieved from the Registry doesn\u0027t end with a path\nsepatator, the prefix check could be satisfied by a sibling directory\nthat starts with the same substring, e.g. \"config\" vs. \"configx\". While\ncode in common.c ensures this, that code could disappear in the future\nleaving the check vulnerable. Instead spend the few CPU cycles to be\nabsolutely sure, we\u0027re doing the right thing here.\n\nDiscovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2.\nContributing Researcher: Vivek Parikh.\n\nReported-by: Vivek Parikh \u003cvivek.parikh@breachx.ai\u003e\nTested-by: Vivek Parikh \u003cvivek.parikh@breachx.ai\u003e\nCVE: 2026-78043\nChange-Id: Ic983a3bf1ee8d4ef98f3883d5e5ddf234696a182\nSigned-off-by: Heiko Hund \u003cheiko@ist.eigentlich.net\u003e\nAcked-by: Razvan Cojocaru \u003crazvanc@mailbox.org\u003e\nAcked-by: Arne Schwabe \u003carne@rfc2549.org\u003e\nGerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1886\nMessage-Id: \u003c20260831184709.3359-1-gert@greenie.muc.de\u003e\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg38854.html\nSigned-off-by: Gert Doering \u003cgert@greenie.muc.de\u003e\n(cherry picked from commit 588af513aac1d2d774fd3fde1716384e3501a5a1)\n"},"branch":"refs/heads/release/2.6"},"2858238f05960e5c7087b39c40cd1671f137a75a":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-09-09 11:24:58.000000000","uploader":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"ref":"refs/changes/07/1907/2","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/07/1907/2","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/07/1907/2 \u0026\u0026 git checkout -b change-1907 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/07/1907/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/07/1907/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/07/1907/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/07/1907/2","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/07/1907/2 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"8020802fd71ee3fd49711e7faffa3a138ef19fac","subject":"openvpnserv: don\u0027t allow \u0027/\u0027 in config paths"}],"author":{"name":"Heiko Hund","email":"heiko@ist.eigentlich.net","date":"2026-08-31 18:47:04.000000000","tz":120},"committer":{"name":"Max Fillinger","email":"maximilian.fillinger@sentyron.com","date":"2026-09-09 11:21:25.000000000","tz":120},"subject":"openvpnserv: harden CheckConfigPath() a bit more","message":"openvpnserv: harden CheckConfigPath() a bit more\n\nIf the config_path retrieved from the Registry doesn\u0027t end with a path\nsepatator, the prefix check could be satisfied by a sibling directory\nthat starts with the same substring, e.g. \"config\" vs. \"configx\". While\ncode in common.c ensures this, that code could disappear in the future\nleaving the check vulnerable. Instead spend the few CPU cycles to be\nabsolutely sure, we\u0027re doing the right thing here.\n\nDiscovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2.\nContributing Researcher: Vivek Parikh.\n\nReported-by: Vivek Parikh \u003cvivek.parikh@breachx.ai\u003e\nTested-by: Vivek Parikh \u003cvivek.parikh@breachx.ai\u003e\nCVE: 2026-78043\nChange-Id: Ic983a3bf1ee8d4ef98f3883d5e5ddf234696a182\nSigned-off-by: Heiko Hund \u003cheiko@ist.eigentlich.net\u003e\nAcked-by: Razvan Cojocaru \u003crazvanc@mailbox.org\u003e\nAcked-by: Arne Schwabe \u003carne@rfc2549.org\u003e\nGerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1886\nMessage-Id: \u003c20260831184709.3359-1-gert@greenie.muc.de\u003e\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg38854.html\nSigned-off-by: Gert Doering \u003cgert@greenie.muc.de\u003e\n(cherry picked from commit 588af513aac1d2d774fd3fde1716384e3501a5a1)\n"},"branch":"refs/heads/release/2.6"},"a453210da741209545b1b6d026a6487151789341":{"kind":"REWORK","_number":3,"created":"2026-09-09 13:25:26.000000000","uploader":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"ref":"refs/changes/07/1907/3","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/07/1907/3","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/07/1907/3 \u0026\u0026 git checkout -b change-1907 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/07/1907/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/07/1907/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/07/1907/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/07/1907/3","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/07/1907/3 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"c1013297930bac77f5d3c4e1ec1ff184870d8804","subject":"openvpnserv: don\u0027t allow \u0027/\u0027 in config paths"}],"author":{"name":"Heiko Hund","email":"heiko@ist.eigentlich.net","date":"2026-08-31 18:47:04.000000000","tz":120},"committer":{"name":"Max Fillinger","email":"maximilian.fillinger@sentyron.com","date":"2026-09-09 13:21:37.000000000","tz":120},"subject":"openvpnserv: harden CheckConfigPath() a bit more","message":"openvpnserv: harden CheckConfigPath() a bit more\n\nIf the config_path retrieved from the Registry doesn\u0027t end with a path\nsepatator, the prefix check could be satisfied by a sibling directory\nthat starts with the same substring, e.g. \"config\" vs. \"configx\". While\ncode in common.c ensures this, that code could disappear in the future\nleaving the check vulnerable. Instead spend the few CPU cycles to be\nabsolutely sure, we\u0027re doing the right thing here.\n\nDiscovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2.\nContributing Researcher: Vivek Parikh.\n\nReported-by: Vivek Parikh \u003cvivek.parikh@breachx.ai\u003e\nTested-by: Vivek Parikh \u003cvivek.parikh@breachx.ai\u003e\nCVE: 2026-78043\nChange-Id: Ic983a3bf1ee8d4ef98f3883d5e5ddf234696a182\nSigned-off-by: Heiko Hund \u003cheiko@ist.eigentlich.net\u003e\nAcked-by: Razvan Cojocaru \u003crazvanc@mailbox.org\u003e\nAcked-by: Arne Schwabe \u003carne@rfc2549.org\u003e\nGerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1886\nMessage-Id: \u003c20260831184709.3359-1-gert@greenie.muc.de\u003e\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg38854.html\nSigned-off-by: Gert Doering \u003cgert@greenie.muc.de\u003e\n(cherry picked from commit 588af513aac1d2d774fd3fde1716384e3501a5a1)\n"},"branch":"refs/heads/release/2.6"}},"requirements":[],"submit_records":[]}