[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 2788-1] strongswan security update



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2788-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                    Thorsten Alteholz
October 20, 2021                              https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : strongswan
Version        : 5.5.1-4+deb9u5
CVE ID         : CVE-2021-41991


Researchers at the United States of America National Security Agency (NSA) identified a denial of services vulnerability in strongSwan, an IKE/IPsec suite.

Once the in-memory certificate cache is full it tries to randomly replace lesser used entries. Depending on the generated random value, this could lead to an integer overflow that results in a double-dereference and a call using out-of-bounds memory that most likely leads to a segmentation fault.

Remote code execution can't be ruled out completely, but attackers have no control over the dereferenced memory, so it seems unlikely at this point.


For Debian 9 stretch, this problem has been fixed in version 5.5.1-4+deb9u5.

We recommend that you upgrade your strongswan packages.

For the detailed security status of strongswan please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/strongswan

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmFvSHhfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcACgkQlvysDTh7
WEcWhxAAibLAim82ATHVNaha5RjA+P9yNvIYWXnOFnwWMJuBjAxXamnJRFXGQSkD
dP0zmHU4+qTdTcXYyG7g9sKTk9KMY+ldrfmPT0fPIxRru1+ny9ssLkPYG/SdDqnZ
ZvDE6ssrEtJ7eBjs3a4i3wCsHCaEbdJW2m2LjtM/NDlOo4T1eh/3YOvzNSxlHagz
zeAC1yqHPDS70EVtA5rPSeAuZM13WvSN/hlVV3XRYpK9ey8CviEHJSNmBN3fi5Wl
zkMltg/MSLoZaQCQGc6HChjNyMrswcHS2InjN3Loq44ZGJbUOo+X1wQodCw/ClRS
p8g/1GjJiaVCm0EriJATc428lVup0pq2gvoZPEwF2bu/AZXGuFN4oK8IBIftERVC
BmP/H6dOe96cUKus1N7Wuw0dTYMjUlYnzRue/TJONOQwXTBeutEE9pY6acSGeHZA
UtzvSpr9i4DQypmcktWfQ8OedNFrFSR37A5hVimhAFwjYi2yeF2bNUn74LCpwfsI
J9GIwjQr9S8ThJxYYfKpBQRAOrcN22APngeZF12IPSu8y06T+HlARBr1MXjF9PyF
5tjkW0QbIjeAziuT4Z2vzAKnWBcDc4V7UxvBpTjWEiZEzy3DRFLMNmovYDTB6tDn
Uw3gY6RbOWscjvQHmIoaX67G1e6T7ce8x5cPwlCWttI2PF6jIX4=
=/OxT
-----END PGP SIGNATURE-----


Reply to: