CVE-2015-4171

2015-06-1018:59:00

Debian Security Bug Tracker

security-tracker.debian.org

0.004 Low

EPSS

Percentile

74.7%

JSON

strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.

OSVersionArchitecturePackageVersionFilename
Debian12allstrongswan< 5.3.1-1strongswan_5.3.1-1_all.deb
Debian11allstrongswan< 5.3.1-1strongswan_5.3.1-1_all.deb
Debian10allstrongswan< 5.3.1-1strongswan_5.3.1-1_all.deb
Debian999allstrongswan< 5.3.1-1strongswan_5.3.1-1_all.deb
Debian13allstrongswan< 5.3.1-1strongswan_5.3.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	strongswan	< 5.3.1-1	strongswan_5.3.1-1_all.deb
Debian	11	all	strongswan	< 5.3.1-1	strongswan_5.3.1-1_all.deb
Debian	10	all	strongswan	< 5.3.1-1	strongswan_5.3.1-1_all.deb
Debian	999	all	strongswan	< 5.3.1-1	strongswan_5.3.1-1_all.deb
Debian	13	all	strongswan	< 5.3.1-1	strongswan_5.3.1-1_all.deb

0.004 Low

EPSS

Percentile

74.7%

JSON

Related for DEBIANCVE:CVE-2015-4171