[SECURITY] [DLA 1522-1] strongswan security update

2018-09-26T16:45:03
ID DEBIAN:DLA-1522-1:8FED5
Type debian
Reporter Debian
Modified 2018-09-26T16:45:03

Description

Package : strongswan Version : 5.2.1-6+deb8u7 CVE ID : CVE-2018-16151 CVE-2018-16152

Sze Yiu Chau and his team from Purdue University and The University of Iowa found several security issues in the gmp plugin for strongSwan, an IKE/IPsec suite.

CVE-2018-16151

The OID parser in the ASN.1 code in gmp allows any number of random
bytes after a valid OID.

CVE-2018-16152

The algorithmIdentifier parser in the ASN.1 code in gmp doesn't
enforce a NULL value for the optional parameter which is not used
with any PKCS#1 algorithm.

For Debian 8 "Jessie", these problems have been fixed in version 5.2.1-6+deb8u7.

We recommend that you upgrade your strongswan packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS