[gentoo-announce] [ GLSA 201811-16 ] strongSwan: Multiple vulnerabilities - gentoo-announce

From:	Aaron Bauman <bman@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 201811-16 ] strongSwan: Multiple vulnerabilities
Date:	Mon, 26 Nov 2018 18:53:37
Message-Id:	`20181126183646.GB20142@monkey`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 201811-16

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: strongSwan: Multiple vulnerabilities

9

     Date: November 26, 2018

10

     Bugs: #648610, #656338, #658230, #668862

11

       ID: 201811-16

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in strongSwan, the worst of

19

which could lead to a Denial of Service condition.

20

21

Background

22

==========

23

24

strongSwan is an IPSec implementation for Linux.

25

26

Affected packages

27

=================

28

29

    -------------------------------------------------------------------

30

     Package              /     Vulnerable     /            Unaffected

31

    -------------------------------------------------------------------

32

  1  net-vpn/strongswan           < 5.7.1                    >= 5.7.1 

33

34

Description

35

===========

36

37

Multiple vulnerabilities have been discovered in strongSwan. Please

38

review the CVE identifiers referenced below for details.

39

40

Impact

41

======

42

43

A remote attacker could cause a Denial of Service condition or

44

impersonate a user.

45

46

Workaround

47

==========

48

49

There is no known workaround at this time.

50

51

Resolution

52

==========

53

54

All strongSwan users should upgrade to the latest version:

55

56

  # emerge --sync

57

  # emerge --ask --oneshot --verbose ">=net-vpn/strongswan-5.7.1"

58

59

References

60

==========

61

62

[ 1 ] CVE-2018-10811

63

      https://nvd.nist.gov/vuln/detail/CVE-2018-10811

64

[ 2 ] CVE-2018-16151

65

      https://nvd.nist.gov/vuln/detail/CVE-2018-16151

66

[ 3 ] CVE-2018-16152

67

      https://nvd.nist.gov/vuln/detail/CVE-2018-16152

68

[ 4 ] CVE-2018-17540

69

      https://nvd.nist.gov/vuln/detail/CVE-2018-17540

70

[ 5 ] CVE-2018-5388

71

      https://nvd.nist.gov/vuln/detail/CVE-2018-5388

72

[ 6 ] CVE-2018-6459

73

      https://nvd.nist.gov/vuln/detail/CVE-2018-6459

74

75

Availability

76

============

77

78

This GLSA and any updates to it are available for viewing at

79

the Gentoo Security Website:

80

81

 https://security.gentoo.org/glsa/201811-16

82

83

Concerns?

84

=========

85

86

Security is a primary focus of Gentoo Linux and ensuring the

87

confidentiality and security of our users' machines is of utmost

88

importance to us. Any security concerns should be addressed to

89

security@g.o or alternatively, you may file a bug at

90

https://bugs.gentoo.org.

91

92

License

93

=======

94

95

Copyright 2018 Gentoo Foundation, Inc; referenced text

96

belongs to its owner(s).

97

98

The contents of this document are licensed under the

99

Creative Commons - Attribution / Share Alike license.

100

101

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 201811-16
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: strongSwan: Multiple vulnerabilities
9	Date: November 26, 2018
10	Bugs: #648610, #656338, #658230, #668862
11	ID: 201811-16
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in strongSwan, the worst of
19	which could lead to a Denial of Service condition.
20
21	Background
22	==========
23
24	strongSwan is an IPSec implementation for Linux.
25
26	Affected packages
27	=================
28
29	-------------------------------------------------------------------
30	Package / Vulnerable / Unaffected
31	-------------------------------------------------------------------
32	1 net-vpn/strongswan < 5.7.1 >= 5.7.1
33
34	Description
35	===========
36
37	Multiple vulnerabilities have been discovered in strongSwan. Please
38	review the CVE identifiers referenced below for details.
39
40	Impact
41	======
42
43	A remote attacker could cause a Denial of Service condition or
44	impersonate a user.
45
46	Workaround
47	==========
48
49	There is no known workaround at this time.
50
51	Resolution
52	==========
53
54	All strongSwan users should upgrade to the latest version:
55
56	# emerge --sync
57	# emerge --ask --oneshot --verbose ">=net-vpn/strongswan-5.7.1"
58
59	References
60	==========
61
62	[ 1 ] CVE-2018-10811
63	https://nvd.nist.gov/vuln/detail/CVE-2018-10811
64	[ 2 ] CVE-2018-16151
65	https://nvd.nist.gov/vuln/detail/CVE-2018-16151
66	[ 3 ] CVE-2018-16152
67	https://nvd.nist.gov/vuln/detail/CVE-2018-16152
68	[ 4 ] CVE-2018-17540
69	https://nvd.nist.gov/vuln/detail/CVE-2018-17540
70	[ 5 ] CVE-2018-5388
71	https://nvd.nist.gov/vuln/detail/CVE-2018-5388
72	[ 6 ] CVE-2018-6459
73	https://nvd.nist.gov/vuln/detail/CVE-2018-6459
74
75	Availability
76	============
77
78	This GLSA and any updates to it are available for viewing at
79	the Gentoo Security Website:
80
81	https://security.gentoo.org/glsa/201811-16
82
83	Concerns?
84	=========
85
86	Security is a primary focus of Gentoo Linux and ensuring the
87	confidentiality and security of our users' machines is of utmost
88	importance to us. Any security concerns should be addressed to
89	security@g.o or alternatively, you may file a bug at
90	https://bugs.gentoo.org.
91
92	License
93	=======
94
95	Copyright 2018 Gentoo Foundation, Inc; referenced text
96	belongs to its owner(s).
97
98	The contents of this document are licensed under the
99	Creative Commons - Attribution / Share Alike license.
100
101	https://creativecommons.org/licenses/by-sa/2.5