Bug 658230 (CVE-2018-10811)

Summary:	<net-vpn/strongswan-5.6.3: missing initialization of a variable in IKEv2 key derivation allows denial of service (CVE-2018-10811)
Product:	Gentoo Security	Reporter:	Vlad K. <vk-gentoo-bugs>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	patrick
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	All
URL:	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10811
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=656338 https://bugs.gentoo.org/show_bug.cgi?id=648610
Whiteboard:	B3 [glsa+ cve]
Package list:		Runtime testing required:	---

Description Vlad K. 2018-06-16 13:54:43 UTC

"A denial-of-service vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS mode and HMAC-MD5 is negotiated as PRF was discovered. All strongSwan versions since 5.0.1 may be affected."

Note: I cannot access strongswan.org sites at the moment to take a look at original advisories.

* https://www.strongswan.org/blog/2018/05/28/strongswan-vulnerability-(cve-2018-10811).html
* https://www.strongswan.org/blog/2018/05/28/strongswan-5.6.3-released.html

Gentoo Security Scout
Vladimir Krstulja

Reproducible: Always

Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev

2018-11-15 12:38:15 UTC

Added to an existing GLSA request.

Comment 2 GLSAMaker/CVETool Bot gentoo-dev

2018-11-26 18:37:29 UTC

This issue was resolved and addressed in
 GLSA 201811-16 at https://security.gentoo.org/glsa/201811-16
by GLSA coordinator Aaron Bauman (b-man).