Debian Long Term Support / LTS Security Information / 2018 / Security Information -- DLA-1522-1 strongswan

Debian Security Advisory

DLA-1522-1 strongswan -- LTS security update

Date Reported:

26 Sep 2018

Affected Packages:

strongswan

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2018-16151, CVE-2018-16152.

More information:

Sze Yiu Chau and his team from Purdue University and The University of Iowa found several security issues in the gmp plugin for strongSwan, an IKE/IPsec suite.

• CVE-2018-16151

  The OID parser in the ASN.1 code in gmp allows any number of random bytes after a valid OID.

• CVE-2018-16152

  The algorithmIdentifier parser in the ASN.1 code in gmp doesn't enforce a NULL value for the optional parameter which is not used with any PKCS#1 algorithm.

For Debian 8 Jessie, these problems have been fixed in version 5.2.1-6+deb8u7.

We recommend that you upgrade your strongswan packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS