This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-45079 →

DEBIAN-CVE-2021-45079

In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the cas...

Original description

The description as published by the source.

In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 strongswan

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.5-1"}]}]

Debian:13 strongswan

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.5-1"}]}]

Debian:14 strongswan

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.5-1"}]}]

References

advisory security-tracker.debian.org