Bug 551562

Summary:	net-misc/strongswan: information leak of user credentials (CVE-2015-4171)
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED DUPLICATE
Severity:	minor
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://strongswan.org/blog/2015/06/08/strongswan-vulnerability-(cve-2015-4171).html
Whiteboard:
Package list:		Runtime testing required:	---

Description Sam James archtester

2015-06-09 14:07:44 UTC

From URL:
----
Alexander E. Patrakov recently reported a vulnerability in strongSwan that may enable rogue servers to obtain user credentials from a client in certain IKEv2 setups. Affected are all strongSwan versions since 4.3.0, up to 5.3.1.
----
http://www.openwall.com/lists/oss-security/2015/05/29/6
Vulnerable versions: >= 4.3.0, < 5.3.1.
Versions in tree:
5.3.2 (unstable) (invulnerable)
5.2.2 (stable) (vulnerable)

Could maintainers please:
1) stabilise 5.3.2
or
2) Apply http://download.strongswan.org/security/CVE-2015-4171/strongswan-5.1.0-5.3.1_enforce_remote_auth.patch (append .sig for PGP signature)

Reproducible: Always

Comment 1 Sam James archtester

2015-06-09 14:12:21 UTC


*** This bug has been marked as a duplicate of bug 551564 ***