Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.3 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.3 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

strongSwan 4.1.2 < 5.9.5 Early EAP-Success Messages Vulnerability

strongSwan is prone to an incorrect handling of early EAP-Success messages vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later Th...

CVE-2021-45079

In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2 even without server authentication...

CVE-2021-45079

In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2 even without server authentication...

ALPINE-CVE-2021-45079

In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2 even without server authentication...

Authentication flaw

In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2 even without server authentication...

CVE-2021-45079

Summary: CVE-2021-45079 affects strongSwan prior to 5.9.5. A malicious responder can send an EAP-Success message before proper authentication, and in EAP methods with mutual authentication and EAP-only authentication for IKEv2, potentially bypassing server authentication. What is affected: strong...

CVE-2021-45079

In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2 even without server authentication...

CVE-2021-45079

In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2 even without server authentication...

CVE-2021-45079

In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2 even without server authentication...

Debian DSA-5056-1 : strongswan - security update

The remote Debian 10 / 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5056 advisory. Zhuowei Zhang discovered a bug in the EAP authentication client code of strongSwan, an IKE/IPsec suite, that may allow to bypass the client and in some scenarios even...

FreeBSD : strongswan - Incorrect Handling of Early EAP-Success Messages (ccaea96b-7dcd-11ec-93df-00224d821998)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ccaea96b-7dcd-11ec-93df-00224d821998 advisory. - In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without...

OESA-2022-1510 wpa_supplicant security update

wpasupplicant is a WPA Supplicant for Linux, BSD, Mac OS X, and Windows with support for WPA and WPA2 IEEE 802.11i / RSN. It is suitable for both desktop/laptop computers and embedded systems. Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key...

SUSE SLES15: strongswan / strongswan-doc / strongswan-hmac / strongswan-ipsec / etc (SUSE-SU-2022:0211-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0211-1 advisory. - CVE-2021-45079: Fixed authentication bypass in EAP authentication. bsc1194471 Tenable has extracted the preceding description block direct...

SUSE: Security Advisory (SUSE-SU-2022:0211-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:0211-1 Security update for strongswan

This update for strongswan fixes the following issues: - CVE-2021-45079: Fixed authentication bypass in EAP authentication. bsc1194471...

SUSE-SU-2022:0202-1 Security update for strongswan

This update for strongswan fixes the following issues: - CVE-2021-45079: Fixed authentication bypass in EAP authentication. bsc1194471...

Authentication Bypass

strongswan is vulnerable to Authentication Bypass. The vulnerability exists due to improper handling of EAP-Success messages. A remote attacker can send a specially crafted early EAP-Success message to the affected system and bypass authentication or perform a denial of service attack...