preparing release 2.6.17

version.m4, ChangeLog, Changes.rst

Signed-off-by: Gert Doering <[email protected]>

Author: cron2

ChangeLog

@@ -1,6 +1,16 @@
 OpenVPN ChangeLog
 Copyright (C) 2002-2025 OpenVPN Inc <[email protected]>
 
+2025.11.28 -- Version 2.6.17
+
+Lev Stipakov (1):
+      interactive.c: harden pipe handling against misbehaving clients
+
+Selva Nair (3):
+      vcpkg-ports/pkcs11-helper: bump version to 1.31
+      Harden interactive service pipe
+      Restrict access to the service pipe to SYSTEM and owner
+
 2025.11.17 -- Version 2.6.16
 
 Antonio Quartulli (1):

Changes.rst

@@ -1,3 +1,20 @@
+Overview of changes in 2.6.17
+=============================
+Bugfixes
+--------
+- Windows/interactive service: fix erroneous exit on error that could be
+  used by a local Windows users to achieve a local denial-of-service
+  (CVE-2025-13751)
+
+Security hardening
+------------------
+- Windows/interactive service: improve service pipe robustness against
+  file access races (uuid) and access by unauthorized processes (ACL).
+
+- upgrade bundled build instruction (vcpkg and patch) for pkcs11-helper
+  to 1.31, fixing a parser bug
+
+
 Overview of changes in 2.6.16
 =============================
 Code maintenance / Compat changes

version.m4

@@ -3,12 +3,12 @@ define([PRODUCT_NAME], [OpenVPN])
 define([PRODUCT_TARNAME], [openvpn])
 define([PRODUCT_VERSION_MAJOR], [2])
 define([PRODUCT_VERSION_MINOR], [6])
-define([PRODUCT_VERSION_PATCH], [.16])
+define([PRODUCT_VERSION_PATCH], [.17])
 m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_MAJOR])
 m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_MINOR], [[.]])
 m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_PATCH], [[]])
 define([PRODUCT_BUGREPORT], [[email protected]])
-define([PRODUCT_VERSION_RESOURCE], [2,6,16,0])
+define([PRODUCT_VERSION_RESOURCE], [2,6,17,0])
 dnl define the TAP version
 define([PRODUCT_TAP_WIN_COMPONENT_ID], [tap0901])
 define([PRODUCT_TAP_WIN_MIN_MAJOR], [9])