[SECURITY] [DLA 2788-1] strongswan security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2788-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Thorsten Alteholz
October 20, 2021 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : strongswan
Version : 5.5.1-4+deb9u5
CVE ID : CVE-2021-41991
Researchers at the United States of America National Security Agency (NSA)
identified a denial of services vulnerability in strongSwan, an
IKE/IPsec suite.
Once the in-memory certificate cache is full it tries to randomly replace
lesser used entries. Depending on the generated random value, this could
lead to an integer overflow that results in a double-dereference and a
call using out-of-bounds memory that most likely leads to a segmentation
fault.
Remote code execution can't be ruled out completely, but attackers have
no control over the dereferenced memory, so it seems unlikely at this
point.
For Debian 9 stretch, this problem has been fixed in version
5.5.1-4+deb9u5.
We recommend that you upgrade your strongswan packages.
For the detailed security status of strongswan please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/strongswan
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmFvSHhfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcACgkQlvysDTh7
WEcWhxAAibLAim82ATHVNaha5RjA+P9yNvIYWXnOFnwWMJuBjAxXamnJRFXGQSkD
dP0zmHU4+qTdTcXYyG7g9sKTk9KMY+ldrfmPT0fPIxRru1+ny9ssLkPYG/SdDqnZ
ZvDE6ssrEtJ7eBjs3a4i3wCsHCaEbdJW2m2LjtM/NDlOo4T1eh/3YOvzNSxlHagz
zeAC1yqHPDS70EVtA5rPSeAuZM13WvSN/hlVV3XRYpK9ey8CviEHJSNmBN3fi5Wl
zkMltg/MSLoZaQCQGc6HChjNyMrswcHS2InjN3Loq44ZGJbUOo+X1wQodCw/ClRS
p8g/1GjJiaVCm0EriJATc428lVup0pq2gvoZPEwF2bu/AZXGuFN4oK8IBIftERVC
BmP/H6dOe96cUKus1N7Wuw0dTYMjUlYnzRue/TJONOQwXTBeutEE9pY6acSGeHZA
UtzvSpr9i4DQypmcktWfQ8OedNFrFSR37A5hVimhAFwjYi2yeF2bNUn74LCpwfsI
J9GIwjQr9S8ThJxYYfKpBQRAOrcN22APngeZF12IPSu8y06T+HlARBr1MXjF9PyF
5tjkW0QbIjeAziuT4Z2vzAKnWBcDc4V7UxvBpTjWEiZEzy3DRFLMNmovYDTB6tDn
Uw3gY6RbOWscjvQHmIoaX67G1e6T7ce8x5cPwlCWttI2PF6jIX4=
=/OxT
-----END PGP SIGNATURE-----
Reply to: