DSA-5056-1 strongswan -- security update

Debian Security Advisory

DSA-5056-1 strongswan -- security update

Date Reported:

24 Jan 2022

Affected Packages:

strongswan

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2021-45079.

More information:

Zhuowei Zhang discovered a bug in the EAP authentication client code of strongSwan, an IKE/IPsec suite, that may allow to bypass the client and in some scenarios even the server authentication, or could lead to a denial-of-service attack.

When using EAP authentication (RFC 3748), the successful completion of the authentication is indicated by an EAP-Success message sent by the server to the client. strongSwan's EAP client code handled early EAP-Success messages incorrectly, either crashing the IKE daemon or concluding the EAP method prematurely.

End result depend on the used configuration, more details can be found in upstream advisory at https://www.strongswan.org/blog/2022/01/24/strongswan-vulnerability-(cve-2021-45079).html

For the oldstable distribution (buster), this problem has been fixed in version 5.7.2-1+deb10u2.

For the stable distribution (bullseye), this problem has been fixed in version 5.9.1-1+deb11u2.

We recommend that you upgrade your strongswan packages.

For the detailed security status of strongswan please refer to its security tracker page at: https://security-tracker.debian.org/tracker/strongswan