OpenVox 8 Release Notes
This page lists the links to the changes in OpenVox 8 and its patch releases. You can also view known issues in this release.
OpenVox’s version numbers follows the Semantic Versioning schema, which splits a version into three segments: Major.Minor.Patch
- Major: must increase for major backward-incompatible changes
- Minor: can increase for backward-compatible new functionality or significant bug fixes
- Patch: can increase for bug fixes
If you’re upgrading from Puppet Open Source
Puppet Open Source is no longer actively developed.
You can either upgrade to Puppet 7 and then switch to OpenVox 7 and then upgrade to OpenVox 8, or you can upgrade to Puppet 8 and then migrate to OpenVox 8.
See Upgrading from Puppet 7 to OpenVox 8 for the changes to review before you move from 7 to 8.
OpenVox 8.33.0
Released November 13, 2026.
This is a feature release of OpenVox.
All bug fixes, new features and other changes are provided on the project’s GitHub release page.
Component changes since 8.32.0
| Component | 8.32.0 | 8.33.0 |
|---|---|---|
| minitar | 1.1.0 | 1.2.0 |
| multi_json | 1.21.2 | 1.19.1 |
| net-ssh | 7.3.6 | 7.3.8 |
| puppet | 8.32.0 | 8.33.0 |
| puppet-runtime | 2026.10.28.1 | 2026.11.12.1 |
OpenVox 8.32.0
Released November 3, 2026.
This is a security release of OpenVox.
All bug fixes, new features and other changes are provided on the project’s GitHub release page.
Notable changes in this release:
- Event data in a report is now read with the same converter that writes it (#766), so a deserialized event holds plain data only.
Before this change, OpenVox Server rebuilt rich values from the event data in a submitted report, and a report whose event carried a crafted
__ptypevalue ran code on the server as thepuppetuser. A client certificate was enough to submit such a report, which on a server that autosigns means any host that can reach it. See GHSA-ffr6-rwpm-p5wq, rated 9.4 critical; the same issue in Puppet Enterprise is CVE-2026-115731. - The issue is reached through the server’s report endpoint, which runs the agent’s Ruby code inside OpenVox Server, so upgrade primary servers and compilers first.
OpenVox Server 8.18.0 requires this release of the agent and restarts the service when it is installed; if you upgrade only the
openvox-agentpackage on a server, restartpuppetserveryourself. Agent-only hosts are not exposed by the issue and can upgrade on their usual schedule. - A rich-typed value written by a Puppet 5 agent is no longer rebuilt into an object; its tagged hash arrives with the reserved keys renamed instead.
- This release is one of a coordinated set with OpenVox Server and OpenVoxDB. The Vox Pupuli announcement lists every affected version and the mitigations available to a server that cannot upgrade yet.
Security Issues Resolved in 8.32.0
| Identifier | CVSS 4.0 Score | Resolved By |
|---|---|---|
| GHSA-ffr6-rwpm-p5wq | 9.4 | pkg:gem/openvox@8.32.0 |
Component changes since 8.31.2
| Component | 8.31.2 | 8.32.0 |
|---|---|---|
| puppet | 8.31.2 | 8.32.0 |
OpenVox 8.31.2
Released October 29, 2026.
This is a security release of OpenVox. It patches the bundled OpenSSL 3.0.22 and Ruby 3.2.11 without changing their versions.
All bug fixes, new features and other changes are provided on the project’s github release page.
Notable changes in this release:
- OpenSSL is patched for the six issues listed as open in 8.31.1 (puppet-runtime#322). OpenSSL 3.0 is past the end of its upstream support, so the patches are the backports that Debian 12 applies to its own OpenSSL 3.0 packages. The version stays at 3.0.22, so scanners that match on the version number still report these CVEs against the agent.
- Ruby is patched with the regular expression compilation fixes from Ruby 3.3.13 (puppet-runtime#321), the bugs that OpenVox 9.2.1 fixed by updating to Ruby 4.0.9. GitLab found that the bugs could be used for remote code execution and published them as CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264; see Ruby’s advisory on regexp compilation fixes. They are reached only when a program compiles a regular expression from untrusted input. Ruby has not assigned CVE identifiers of its own for them, so they do not appear in scans of OpenVox’s bundled components.
Security Issues Resolved in 8.31.2
| Identifier | CVSS 3.1 Score | Resolved By |
|---|---|---|
| CVE-2026-84782 | 8.2 | pkg:github/openssl/openssl@3.0.22 |
| CVE-2026-75806 | 5.3 | pkg:github/openssl/openssl@3.0.22 |
| CVE-2026-75805 | 5.3 | pkg:github/openssl/openssl@3.0.22 |
| CVE-2026-35189 | 5.3 | pkg:github/openssl/openssl@3.0.22 |
| CVE-2026-54872 | 3.7 | pkg:github/openssl/openssl@3.0.22 |
| CVE-2026-77696 | 3.7 | pkg:github/openssl/openssl@3.0.22 |
OpenVox 8.31.1
Released October 21, 2026.
This is a security release of OpenVox. It refreshes the CA trust store and updates curl to 8.23.0.
All bug fixes, new features and other changes are provided on the project’s github release page.
Notable changes in this release:
- The CA certificate bundle at
/opt/puppetlabs/puppet/ssl/cert.pemand the Java keystore at/opt/puppetlabs/puppet/ssl/puppet-cacertsare rebuilt from the Mozilla root store as shipped in NSS 3.131.1 (puppet-ca-bundle 1.1.1). The rebuild removes theemSign Root CA - C1,emSign ECC Root CA - C3, andemSign ECC Root CA - G3roots after eMudhra’s private keys were found to be exposed. The bundle is what the agent’s Ruby, OpenSSL, and curl trust when connecting to servers with publicly issued certificates, such as the Forge,httpsfile sources, and gem installs. It plays no part in the trust between agents and the OpenVox server, which comes from the OpenVox CA inssldir. - The upgrade replaces
cert.pem, so a CA that you appended to that file has to be added again. Adding a custom CA for HTTPS-inspecting proxies describes the ways that survive upgrades. - curl is updated to 8.23.0, which fixes a use-after-free during HTTP/2 uploads (CVE-2026-92392).
- Bundled gems are updated, including fast_gettext 4.1.1, multi_json 1.21.2, and net-ssh 7.3.6.
- OpenSSL 3.0, which OpenVox 8 bundles, reached the end of its upstream support on September 7, 2026 and no longer receives fixes. The OpenSSL issues listed as open on the release page are not fixed in this release; 8.31.2 patches them. OpenVox 9 bundles OpenSSL 3.5, the current long-term-support line; see Upgrading from OpenVox 8 to OpenVox 9.
Security Issues Resolved in 8.31.1
| Identifier | CVSS 3.1 Score | Resolved By |
|---|---|---|
| CVE-2026-92392 | 8.1 | pkg:github/curl/curl@8.23.0 |
OpenVox 8.31.0
Released October 13, 2026.
This is a feature release of OpenVox. It adds support for version 3 of the json gem and updates bundled components.
All bug fixes, new features and other changes are provided on the project’s github release page.
Notable changes in this release:
- The agent works with version 3 of the
jsongem (#721, a backport of #706). An agent installed from theopenvoxgem or from a distribution package, on a Ruby that has json 3 installed, failed every request to the server withFailed to deserialize ... from json: wrong number of arguments (given 2, expected 1), andpuppet facts showfailed withuninitialized constant JSON::PRETTY_STATE_PROTOTYPE. Theopenvox-agentpackages bundle json 2 and were not affected. On json 3, a JSON document with a duplicated key, such as a module’smetadata.json, is rejected instead of silently keeping the last value. - Bundled components are updated, including Augeas 1.15.0. It is the first Augeas release since 2023 and adds an
Aptsources822lens for Deb822-style apt.sourcesfiles,leapseclistin the Chrony lens,/usr/share/iproute2in the IPRoute2 lens, and/etc/nginx/snippetsin the Nginx lens, among other lens changes listed in the Augeas release notes. Augeas 1.15.0 also carries the upstream fix for CVE-2025-2588, which OpenVox agents have had as a patch to Augeas 1.14.1 since 8.23.0, so this release resolves no new security issues.
OpenVox 8.30.0
Released October 7, 2026.
This is a bug-fix and security release of OpenVox.
All bug fixes, new features and other changes are provided on the project’s github release page.
Notable changes in this release:
- The agent daemon waits for its certificate in the forked child instead of in the daemon process, and kills a forked run that outlives
runtimeoutinstead of blocking until the service is restarted (#485). - Resolving a
Deferredvalue that calls a Puppet-language function no longer fails for lack of a global scope. - The
Loading factsmessage is printed once per run instead of once for every directory searched for facts. - Bundled components are updated, including OpenFact 5.7.2 and libxml2 2.15.4.
Security Issues Resolved in 8.30.0
| Identifier | CVSS 3.1 Score | Resolved By |
|---|---|---|
| CVE-2026-86138 | 7.8 | pkg:github/gnome/libxml2@2.15.4 |
| CVE-2026-86139 | 7.8 | pkg:github/gnome/libxml2@2.15.4 |
| CVE-2026-86140 | 7.8 | pkg:github/gnome/libxml2@2.15.4 |
| CVE-2026-86142 | 7.8 | pkg:github/gnome/libxml2@2.15.4 |
| CVE-2026-86144 | 7.8 | pkg:github/gnome/libxml2@2.15.4 |
| CVE-2026-86143 | 7.3 | pkg:github/gnome/libxml2@2.15.4 |
| CVE-2026-86137 | 6.1 | pkg:github/gnome/libxml2@2.15.4 |
| CVE-2026-86141 | 3.3 | pkg:github/gnome/libxml2@2.15.4 |
OpenVox 8.29.0
Released September 4, 2026.
This is a bug-fix and security release of OpenVox.
All bug fixes, new features and other changes are provided on the project’s github release page.
Security Issues Resolved in 8.29.0
| Identifier | CVSS 3.1 Score | Resolved By |
|---|---|---|
| CVE-2026-75803 | 9.1 | pkg:github/openssl/openssl@3.0.22 |
| CVE-2026-54874 | 7.5 | pkg:github/openssl/openssl@3.0.22 |
| CVE-2026-63072 | 7.5 | pkg:github/openssl/openssl@3.0.22 |
| CVE-2026-63076 | 7.5 | pkg:github/openssl/openssl@3.0.22 |
| CVE-2026-63074 | 5.9 | pkg:github/openssl/openssl@3.0.22 |
| CVE-2026-19931 | N/A | pkg:github/curl/curl@8.22.0 |
| CVE-2026-13608 | N/A | pkg:github/curl/curl@8.22.0 |
| CVE-2026-18924 | N/A | pkg:github/curl/curl@8.22.0 |
| CVE-2026-80229 | N/A | pkg:github/curl/curl@8.22.0 |
| CVE-2026-80230 | N/A | pkg:github/curl/curl@8.22.0 |
| CVE-2026-80231 | N/A | pkg:github/curl/curl@8.22.0 |
| CVE-2026-80255 | N/A | pkg:github/curl/curl@8.22.0 |
| CVE-2026-82208 | N/A | pkg:github/curl/curl@8.22.0 |
| CVE-2026-82209 | N/A | pkg:github/curl/curl@8.22.0 |
OpenVox 8.28.1
Released July 8, 2026.
This is a bug-fix and security release of OpenVox.
All bug fixes, new features and other changes are provided on the project’s github release page.
Security Issues Resolved in 8.28.1
| Identifier | CVSS 3.1 Score | Resolved By |
|---|---|---|
| CVE-2026-54906 | 9.8 | pkg:gem/concurrent-ruby@1.3.7 |
| CVE-2026-54904 | 7.5 | pkg:gem/concurrent-ruby@1.3.7 |
| CVE-2026-54905 | 5.5 | pkg:gem/concurrent-ruby@1.3.7 |
| CVE-2026-47242 | N/A | pkg:gem/net-imap@0.6.4.1 |
| CVE-2026-47241 | N/A | pkg:gem/net-imap@0.6.4.1 |
| CVE-2026-47240 | N/A | pkg:gem/net-imap@0.6.4.1 |
| CVE-2026-8804 | 6.7 | pkg:gem/puppet-resource_api@1.9.2 |
| CVE-2026-8925 | 9.8 | pkg:github/curl/curl@8.21.0 |
| CVE-2026-11856 | 9.8 | pkg:github/curl/curl@8.21.0 |
| CVE-2026-9079 | 9.8 | pkg:github/curl/curl@8.21.0 |
| CVE-2026-10536 | 9.8 | pkg:github/curl/curl@8.21.0 |
| CVE-2026-8927 | 9.1 | pkg:github/curl/curl@8.21.0 |
| CVE-2026-8924 | 9.1 | pkg:github/curl/curl@8.21.0 |
| CVE-2026-11564 | 9.1 | pkg:github/curl/curl@8.21.0 |
| CVE-2026-8926 | 9.1 | pkg:github/curl/curl@8.21.0 |
| CVE-2026-8286 | 8.1 | pkg:github/curl/curl@8.21.0 |
| CVE-2026-11352 | 7.5 | pkg:github/curl/curl@8.21.0 |
| CVE-2026-11586 | 7.5 | pkg:github/curl/curl@8.21.0 |
| CVE-2026-9546 | 7.5 | pkg:github/curl/curl@8.21.0 |
| CVE-2026-12064 | 7.5 | pkg:github/curl/curl@8.21.0 |
| CVE-2026-9545 | 7.5 | pkg:github/curl/curl@8.21.0 |
| CVE-2026-8932 | 7.5 | pkg:github/curl/curl@8.21.0 |
| CVE-2026-9547 | 7.4 | pkg:github/curl/curl@8.21.0 |
| CVE-2026-9080 | 7.3 | pkg:github/curl/curl@8.21.0 |
| CVE-2026-8458 | 6.5 | pkg:github/curl/curl@8.21.0 |
OpenVox 8.28.0
Released June 10, 2026.
This is a bug-fix and security release of OpenVox.
All bug fixes, new features and other changes are provided on the project’s github release page.
Security Issues Resolved in 8.28.0
| Identifier | CVSS 3.1 Score | Resolved By |
|---|---|---|
| CVE-2026-34182 | 9.1 | pkg:github/openssl/openssl@3.0.21 |
| CVE-2026-45447 | 8.8 | pkg:github/openssl/openssl@3.0.21 |
| CVE-2026-7383 | 8.1 | pkg:github/openssl/openssl@3.0.21 |
| CVE-2026-45445 | 7.5 | pkg:github/openssl/openssl@3.0.21 |
| CVE-2026-34180 | 7.5 | pkg:github/openssl/openssl@3.0.21 |
| CVE-2026-9076 | 7.5 | pkg:github/openssl/openssl@3.0.21 |
| CVE-2026-42766 | 5.9 | pkg:github/openssl/openssl@3.0.21 |
| CVE-2026-45446 | 4.8 | pkg:github/openssl/openssl@3.0.21 |
| CVE-2026-42770 | 3.7 | pkg:github/openssl/openssl@3.0.21 |
OpenVox 8.27.0
Released May 18, 2026.
This is a bug-fix and security release of OpenVox.
All bug fixes, new features and other changes are provided on the project’s github release page.
Security Issues Resolved in 8.27.0
| Identifier | CVSS 3.1 Score | Resolved By |
|---|---|---|
| CVE-2026-41316 | 8.1 | pkg:gem/erb@4.0.3.1 |
| CVE-2026-42258 | 9.8 | pkg:gem/net-imap@0.4.24 |
| CVE-2026-42257 | 9.8 | pkg:gem/net-imap@0.4.24 |
| CVE-2026-42245 | 7.5 | pkg:gem/net-imap@0.4.24 |
| CVE-2026-42246 | 7.4 | pkg:gem/net-imap@0.4.24 |
| CVE-2026-5773 | 7.5 | pkg:github/curl/curl@8.20.0 |
| CVE-2026-6276 | 7.5 | pkg:github/curl/curl@8.20.0 |
| CVE-2026-5545 | 6.5 | pkg:github/curl/curl@8.20.0 |
| CVE-2026-6253 | 5.9 | pkg:github/curl/curl@8.20.0 |
| CVE-2026-4873 | 5.9 | pkg:github/curl/curl@8.20.0 |
| CVE-2026-7168 | 5.3 | pkg:github/curl/curl@8.20.0 |
| CVE-2026-6429 | 5.3 | pkg:github/curl/curl@8.20.0 |
| CVE-2026-7009 | 5.3 | pkg:github/curl/curl@8.20.0 |
| CVE-2026-6732 | 7.5 | pkg:github/gnome/libxml2@2.15.3 |
OpenVox 8.26.2
Released April 18, 2026.
This is a bug-fix release of OpenVox.
All bug fixes, new features and other changes are provided on the project’s github release page.
OpenVox 8.26.1
Released April 16, 2026.
This is a bug-fix release of OpenVox.
All bug fixes, new features and other changes are provided on the project’s github release page.
OpenVox 8.26.0
Released April 14, 2026.
This is a bug-fix and security release of OpenVox.
All bug fixes, new features and other changes are provided on the project’s github release page.
Security Issues Resolved in 8.26.0
| Identifier | CVSS 3.1 Score | Resolved By |
|---|---|---|
| CVE-2026-27820 | 9.8 | pkg:gem/zlib@3.0.1 |
| CVE-2026-3805 | 7.5 | pkg:github/curl/curl@8.19.0 |
| CVE-2026-1965 | 6.5 | pkg:github/curl/curl@8.19.0 |
| CVE-2026-3784 | 6.5 | pkg:github/curl/curl@8.19.0 |
| CVE-2026-3783 | 5.3 | pkg:github/curl/curl@8.19.0 |
| CVE-2026-31789 | 9.8 | pkg:github/openssl/openssl@3.0.20 |
| CVE-2026-28387 | 8.1 | pkg:github/openssl/openssl@3.0.20 |
| CVE-2026-28389 | 7.5 | pkg:github/openssl/openssl@3.0.20 |
| CVE-2026-28390 | 7.5 | pkg:github/openssl/openssl@3.0.20 |
| CVE-2026-28388 | 7.5 | pkg:github/openssl/openssl@3.0.20 |
| CVE-2026-31790 | 7.5 | pkg:github/openssl/openssl@3.0.20 |
OpenVox 8.25.0
Released February 17, 2026.
This is a bug-fix and security release of OpenVox.
All bug fixes, new features and other changes are provided on the project’s github release page.
Security Issues Resolved in 8.25.0
| Identifier | CVSS 3.1 Score | Resolved By |
|---|---|---|
| CVE-2025-24294 | 5.3 | pkg:gem/resolv@0.2.3 |
| CVE-2025-61594 | 7.5 | pkg:gem/uri@0.12.5 |
| CVE-2025-14017 | 6.3 | pkg:github/curl/curl@8.18.0 |
| CVE-2025-13034 | 5.9 | pkg:github/curl/curl@8.18.0 |
| CVE-2025-14819 | 5.3 | pkg:github/curl/curl@8.18.0 |
| CVE-2025-15079 | 5.3 | pkg:github/curl/curl@8.18.0 |
| CVE-2025-14524 | 5.3 | pkg:github/curl/curl@8.18.0 |
| CVE-2025-15224 | 3.1 | pkg:github/curl/curl@8.18.0 |
| CVE-2025-15467 | 8.8 | pkg:github/openssl/openssl@3.0.19 |
| CVE-2025-69419 | 7.4 | pkg:github/openssl/openssl@3.0.19 |
| CVE-2026-22795 | 5.5 | pkg:github/openssl/openssl@3.0.19 |
| CVE-2026-22796 | 5.3 | pkg:github/openssl/openssl@3.0.19 |
| CVE-2025-68160 | 4.7 | pkg:github/openssl/openssl@3.0.19 |
| CVE-2025-69418 | 4.0 | pkg:github/openssl/openssl@3.0.19 |