[SECURITY] [DSA 6041-1] strongswan security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6041-1 security@debian.org
https://www.debian.org/security/ Yves-Alexis Perez
October 27, 2025 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : strongswan
CVE ID : CVE-2025-62291
Xu Biang discovered a buffer overflow bug in the eap-mschapv2 plugin of
strongSwan, an IKE/IPsec suite.
The eap-mschapv2 plugin doesn't correctly check the length of an
EAP-MSCHAPv2 Failure Request packet on the client, which can cause an
integer underflow that leads to a crash, and a heap-based buffer
overflow that's potentially exploitable for remote code execution.
For the oldstable distribution (bookworm), this problem has been fixed
in version 5.9.8-5+deb12u2.
For the stable distribution (trixie), this problem has been fixed in
version 6.0.1-6+deb13u2.
We recommend that you upgrade your strongswan packages.
For the detailed security status of strongswan please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/strongswan
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmj/mn5fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0SJCQ/7B1VAo+xA+jS6ChvX8OjZKWTWxCspeOJwibI4sRwCv4dGB7pMvznGxs/y
HMHfsB0ffTy8lBMv5Ne1FHsHTIGrhvYkHkJCLu4aFg9aoj+yeimhoG2SOdi21Pnj
bMN4x5hOXpTaZLePVvZuU/NgjpRiG2dB0DEApVUKcEVZmzIZW08RyR5uLxshxfhu
SBCt0xxO1XsmJu3Nob32Z/LtboRxQTbBsf7BlYWKOUx/X666wcAQHXqqeuJ52CMp
yvDm3d/JSuFlK1JqF9ZwULv64cgIqlyztmYm14u29M1bwm4s/Z7DsSOoEJtW17Lf
pOjNMUc0B3MqyGJRHTTqEDQ4GfhNEgsCTdLDrGWdLieN2tH8FhX8+e8qxkls7mbC
F2Bvtoklebiq3fic9QyCT1v69cnzHZl8ImIeCu2RmS8jQqn1nsWOTCSqDYOA7rN9
bd03+uECn7UTPUaId+AIjdcwnWIg4EWTUdofLoH2TCk3ERW4/etFzHsOiGCfdjhU
Gao6422b5xlzQIzG6nYVklh00SVGs5lRRMzkj15TDuK/BeejkO7xXmDM51J6/1S9
5AvwsB8Dgc2ipHOSgA7MTojVkv+yOGWjPHiZKhNNi4ffKkXN767nAQKWkyybk4+6
+VT0zR61L13ykdT6OOK89JAHKqfcf/UYCtwRsemRpQX2s3PEAMs=
=rfUx
-----END PGP SIGNATURE-----
Reply to: