Package: strongswan Severity: serious Tags: security patch -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Hi, the following CVE (Common Vulnerabilities & Exposures) id was published for strongswan. CVE-2009-2661[0]: | The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before | 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 | certificates with crafted Relative Distinguished Names (RDNs), which | allows remote attackers to cause a denial of service (pluto IKE daemon | crash) via malformed ASN.1 data. NOTE: this is due to an incomplete | fix for CVE-2009-2185. If you fix the vulnerability please also make sure to include the CVE id in your changelog entry. For further information see: [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2661 http://security-tracker.debian.net/tracker/CVE-2009-2661 Patch: http://download.strongswan.org/patches/07_asn1_length_patch/ Cheers, Giuseppe. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkp6f00ACgkQNxpp46476aqs8gCeJOTbmBQVtDZI7WJ5f/xy7tNk F4oAni7A4FaHHaq/5CHSZfhZkdo9r2Jm =mQTb -----END PGP SIGNATURE----- -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
