FreeBSD: VID-e5cf9f44-9a64-11f0-8241-93c889bb8de1 (CVE-2025-10680): openvpn-devel -- script injection vulnerability from trusted but malicious server

Gert Doering reports: Notable changes beta1 -> beta2 are: [...] add proper input sanitation to DNS strings to prevent an attack coming from a trusted-but-malicous OpenVPN server (CVE: 2025-10680, affects unixoid systems with --dns-updown scripts and windows using the built-in powershell call) Lev Stipakov writes: On Linux (and similar platforms), those options are written to a tmp file, which is later sourced by a script running as root. Since options are controlled by the server, it is possible for a malicious server to execute script injection attack [...]. The original report is credited to Stanislav Fort <[email protected]>.