From 28c87166ba6629abf5aa3a5e35bc5e1ad3c21970 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20L=C3=B6nnhager?= Date: Fri, 1 Dec 2023 16:49:55 +0100 Subject: [PATCH 1/2] Bump binaries submodule This upgrades openvpn to 2.6.8, fixing CVE-2023-46850, which could cause freed memory to be sent to the peer. --- dist-assets/binaries | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dist-assets/binaries b/dist-assets/binaries index d9db5c930cb3..d5772339cee9 160000 --- a/dist-assets/binaries +++ b/dist-assets/binaries @@ -1 +1 @@ -Subproject commit d9db5c930cb3eb1d3ee048e5546be6377dedf8ab +Subproject commit d5772339cee9c1a0d7671968746f02499b78e245 From 9bb0cb62d68c4e9014d939ed1fb321c56a7987f3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20L=C3=B6nnhager?= Date: Mon, 4 Dec 2023 16:57:18 +0100 Subject: [PATCH 2/2] Update changelog --- CHANGELOG.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7be653e994af..f093a547d68d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -26,6 +26,8 @@ Line wrap the file at 100 chars. Th - Add CLI support for applying patches to the settings with `mullvad import-settings`. ### Changed +- Update OpenVPN to 2.6.8 from 2.6.0. + #### Android - Migrate welcome view to compose. - Migrate in app notifications to compose. @@ -47,6 +49,10 @@ Line wrap the file at 100 chars. Th #### Linux - Prevent fragmentation when multihop is enabled by setting a default route MTU. +### Security +- Update OpenVPN to 2.6.8 to fix CVE-2023-46850, which could cause freed memory to be sent to the + peer. + ## [2023.6-beta1] - 2023-11-23 ### Added