[SECURITY] [DLA 1522-1] strongswan security update

2018-09-2616:44:37

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.011 Low

EPSS

Percentile

83.9%

JSON

Package : strongswan
Version : 5.2.1-6+deb8u7
CVE ID : CVE-2018-16151 CVE-2018-16152

Sze Yiu Chau and his team from Purdue University and The University of
Iowa found several security issues in the gmp plugin for strongSwan,
an IKE/IPsec suite.

CVE-2018-16151

The OID parser in the ASN.1 code in gmp allows any number of random
bytes after a valid OID.

CVE-2018-16152

The algorithmIdentifier parser in the ASN.1 code in gmp doesn&#x27;t
enforce a NULL value for the optional parameter which is not used
with any PKCS#1 algorithm.

For Debian 8 "Jessie", these problems have been fixed in version
5.2.1-6+deb8u7.

We recommend that you upgrade your strongswan packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian9mipscharon-cmd< 5.5.1-4+deb9u3charon-cmd_5.5.1-4+deb9u3_mips.deb
Debian9ppc64elstrongswan-pki-dbgsym< 5.5.1-4+deb9u3strongswan-pki-dbgsym_5.5.1-4+deb9u3_ppc64el.deb
Debian9armelcharon-systemd-dbgsym< 5.5.1-4+deb9u3charon-systemd-dbgsym_5.5.1-4+deb9u3_armel.deb
Debian9armellibcharon-extra-plugins-dbgsym< 5.5.1-4+deb9u3libcharon-extra-plugins-dbgsym_5.5.1-4+deb9u3_armel.deb
Debian9mipslibstrongswan-standard-plugins-dbgsym< 5.5.1-4+deb9u3libstrongswan-standard-plugins-dbgsym_5.5.1-4+deb9u3_mips.deb
Debian9armelstrongswan-charon< 5.5.1-4+deb9u3strongswan-charon_5.5.1-4+deb9u3_armel.deb
Debian9mipsstrongswan-libcharon-dbgsym< 5.5.1-4+deb9u3strongswan-libcharon-dbgsym_5.5.1-4+deb9u3_mips.deb
Debian9i386strongswan-scepclient< 5.5.1-4+deb9u3strongswan-scepclient_5.5.1-4+deb9u3_i386.deb
Debian9allstrongswan-ike< 5.5.1-4+deb9u3strongswan-ike_5.5.1-4+deb9u3_all.deb
Debian9arm64strongswan-starter-dbgsym< 5.5.1-4+deb9u3strongswan-starter-dbgsym_5.5.1-4+deb9u3_arm64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	mips	charon-cmd	< 5.5.1-4+deb9u3	charon-cmd_5.5.1-4+deb9u3_mips.deb
Debian	9	ppc64el	strongswan-pki-dbgsym	< 5.5.1-4+deb9u3	strongswan-pki-dbgsym_5.5.1-4+deb9u3_ppc64el.deb
Debian	9	armel	charon-systemd-dbgsym	< 5.5.1-4+deb9u3	charon-systemd-dbgsym_5.5.1-4+deb9u3_armel.deb
Debian	9	armel	libcharon-extra-plugins-dbgsym	< 5.5.1-4+deb9u3	libcharon-extra-plugins-dbgsym_5.5.1-4+deb9u3_armel.deb
Debian	9	mips	libstrongswan-standard-plugins-dbgsym	< 5.5.1-4+deb9u3	libstrongswan-standard-plugins-dbgsym_5.5.1-4+deb9u3_mips.deb
Debian	9	armel	strongswan-charon	< 5.5.1-4+deb9u3	strongswan-charon_5.5.1-4+deb9u3_armel.deb
Debian	9	mips	strongswan-libcharon-dbgsym	< 5.5.1-4+deb9u3	strongswan-libcharon-dbgsym_5.5.1-4+deb9u3_mips.deb
Debian	9	i386	strongswan-scepclient	< 5.5.1-4+deb9u3	strongswan-scepclient_5.5.1-4+deb9u3_i386.deb
Debian	9	all	strongswan-ike	< 5.5.1-4+deb9u3	strongswan-ike_5.5.1-4+deb9u3_all.deb
Debian	9	arm64	strongswan-starter-dbgsym	< 5.5.1-4+deb9u3	strongswan-starter-dbgsym_5.5.1-4+deb9u3_arm64.deb