This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2021-45079 →
UBUNTU-CVE-2021-45079
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the cas...
Original description
The description as published by the source.
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:Pro:14.04:LTS
strongswan
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-0ubuntu2.11+esm2"}]}]
Ubuntu:Pro:16.04:LTS
strongswan
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.5-1ubuntu3.8+esm2"}]}]
Ubuntu:Pro:FIPS-updates:16.04:LTS
strongswan
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.5-1ubuntu3.fips.3.8.3"}]}]
Ubuntu:Pro:FIPS:16.04:LTS
strongswan
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:18.04:LTS
strongswan
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2-1ubuntu2.8"}]}]
Ubuntu:Pro:FIPS-updates:18.04:LTS
strongswan
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2-1ubuntu2.fips.2.8.1"}]}]
Ubuntu:Pro:FIPS:18.04:LTS
strongswan
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:20.04:LTS
strongswan
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.2-1ubuntu3.4"}]}]
Ubuntu:Pro:FIPS-updates:20.04:LTS
strongswan
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.2-1ubuntu3.fips.3.4.1"}]}]
Ubuntu:Pro:FIPS:20.04:LTS
strongswan
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
strongswan
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.4-1ubuntu4"}]}]
References
- advisory ubuntu.com
- advisory ubuntu.com
- report ubuntu.com
- report github.com
- report strongswan.org
- report cve.org