From URL: ---- Alexander E. Patrakov recently reported a vulnerability in strongSwan that may enable rogue servers to obtain user credentials from a client in certain IKEv2 setups. Affected are all strongSwan versions since 4.3.0, up to 5.3.1. ---- http://www.openwall.com/lists/oss-security/2015/05/29/6 Vulnerable versions: >= 4.3.0, < 5.3.1. Versions in tree: 5.3.2 (unstable) (invulnerable) 5.2.2 (stable) (vulnerable) Could maintainers please: 1) stabilise 5.3.2 or 2) Apply http://download.strongswan.org/security/CVE-2015-4171/strongswan-5.1.0-5.3.1_enforce_remote_auth.patch (append .sig for PGP signature) Reproducible: Always
*** This bug has been marked as a duplicate of bug 551564 ***