Debian Security Advisory
DSA-4309-1 strongswan -- security update
- Date Reported:
- 01 Oct 2018
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2018-17540.
- More information:
An attacker could trigger it using crafted certificates with RSA keys with very small moduli. Verifying signatures with such keys would cause an integer underflow and subsequent heap buffer overflow resulting in a crash of the daemon. While arbitrary code execution is not completely ruled out because of the heap buffer overflow, due to the form of the data written to the buffer it seems difficult to actually exploit it in such a way.
For the stable distribution (stretch), this problem has been fixed in version 5.5.1-4+deb9u4.
We recommend that you upgrade your strongswan packages.
For the detailed security status of strongswan please refer to its security tracker page at: https://security-tracker.debian.org/tracker/strongswan