Public bug reported: A new release of strongswan is available for merging from Debian.
Ubuntu: 6.0.7-1ubuntu3 Debian Unstable: 6.1.0-2 ### New Debian Changes ### strongswan (6.1.0-2) unstable; urgency=medium * also disable padlock plugin (fix FTBFS on i386) * d/NEWS: mentions disabled plugins * d/rules: cleanup a little for removed plugins -- Yves-Alexis Perez <[email protected]> Tue, 08 Sep 2026 07:51:17 +0200 strongswan (6.1.0-1) unstable; urgency=medium * New upstream version 6.1.0 * Includes multiple security fixes - fix for undefined memory access when verifying PKCS#7 containers (CVE-2026-78123) - patch to fix memory leaks after enumerating certificates in PKCS#7 containers (CVE-2026-78124) - fix NULL-pointer dereference in EAP-AKA (CVE-2026-78126) - avoid memory leak in IKE message logging (CVE-2026-78127) - fix potential DoS by validating PKCS#5 parsed parameters (CVE-2026-78129) - fix NULL-pointer dereference in x509 code (CVE-2026-78130) - fix memory leak when parsing x509 attribute certificates (CVE-2026-78131) - fix infinite loop when parsing x509 attribute certificates (CVE-2026-78132) - fix use-after-free in IKEv2 rekeying (CVE-2026-78133) - fix several issues with binding identities to the IKE SA (CVE-2026-78134) - properly reject CREATE_CHILD_SA requests on unestablished IKE_SA (CVE-2026-78135) * remove plugins obsoleted in 6.1.0 * document IKEv1 protocol as disabled -- Yves-Alexis Perez <[email protected]> Mon, 07 Sep 2026 21:31:11 +0200 ### Old Ubuntu Delta ### strongswan (6.0.7-1ubuntu3) stonking; urgency=medium * SECURITY UPDATE: Undefined Memory Access When Handling PKCS#7 Containers - debian/patches/CVE-2026-78123.patch: openssl: Fix undefined memory access when verifying PKCS#7 containers in src/libstrongswan/plugins/openssl/openssl_pkcs7.c. - CVE-2026-78123 * SECURITY UPDATE: Memory Leak When Processing Certificates in PKCS#7 Containers - debian/patches/CVE-2026-78124.patch: openssl: Fix memory leaks after enumerating certificates in PKCS#7 container in src/libstrongswan/plugins/openssl/openssl_pkcs7.c. - CVE-2026-78124 * SECURITY UPDATE: NULL-Pointer Dereference When Handling AKA-Synchronization-Failure - debian/patches/CVE-2026-78126.patch: eap-aka: Only accept AKA- Synchronization-Failure if expected in src/libcharon/plugins/eap_aka/eap_aka_server.c. - CVE-2026-78126 * SECURITY UPDATE: Memory Leak During Message Stringification - debian/patches/CVE-2026-78127.patch: message: Avoid memory leak if string buffer for message is too small in src/libcharon/encoding/message.c. - CVE-2026-78127 * SECURITY UPDATE: Unbounded Iteration When Decrypting PKCS#7 Containers - debian/patches/CVE-2026-78129.patch: pkcs5: Validate parsed parameters to avoid DoS attacks in src/libstrongswan/crypto/pkcs5.c. - CVE-2026-78129 * SECURITY UPDATE: NULL-Pointer Dereference in Attribute Certificate Validation - debian/patches/CVE-2026-78130.patch: x509: Avoid NULL-pointer dereference if issuerName is missing in attribute certificate in src/libstrongswan/plugins/x509/x509_ac.c. - CVE-2026-78130 * SECURITY UPDATE: Memory Leaks When Parsing Attribute Certificates - debian/patches/CVE-2026-78131.patch: x509: Fix memory leaks when parsing attribute certificates in src/libstrongswan/plugins/x509/x509_ac.c. - CVE-2026-78131 * SECURITY UPDATE: Infinite Loop When Parsing Attribute Certificates - debian/patches/CVE-2026-78132.patch: x509: Prevent infinite loop when parsing ietfAttrSyntax in attribute certificates in src/libstrongswan/plugins/x509/x509_ac.c. - CVE-2026-78132 * SECURITY UPDATE: Use-After-Free During Multi-KE Rekey Collision - debian/patches/CVE-2026-78133.patch: ikev2: Prevent use-after-free during collision after passive multi-KE rekeying failed in src/libcharon/sa/ikev2/task_manager_v2.c, src/libcharon/sa/ikev2/tasks/child_rekey.c, src/libcharon/sa/ikev2/tasks/child_rekey.h, src/libcharon/sa/ikev2/tasks/ike_rekey.c, src/libcharon/sa/ikev2/tasks/ike_rekey.h, src/libcharon/tests/suites/test_child_rekey.c, src/libcharon/tests/suites/test_ike_rekey.c. - CVE-2026-78133 * SECURITY UPDATE: Missing Inner EAP Method Authentication Details - debian/patches/CVE-2026-78134.patch: eap-ttls/peap: Return auth-cfg with details on TLS and inner EAP method in src/libcharon/plugins/eap_peap/eap_peap.c, src/libcharon/plugins/eap_peap/eap_peap_peer.c, src/libcharon/plugins/eap_peap/eap_peap_peer.h, src/libcharon/plugins/eap_peap/eap_peap_server.c, src/libcharon/plugins/eap_peap/eap_peap_server.h, src/libcharon/plugins/eap_ttls/eap_ttls.c, src/libcharon/plugins/eap_ttls/eap_ttls_peer.c, src/libcharon/plugins/eap_ttls/eap_ttls_peer.h, src/libcharon/plugins/eap_ttls/eap_ttls_server.c, src/libcharon/plugins/eap_ttls/eap_ttls_server.h. - CVE-2026-78134 * SECURITY UPDATE: Creation of a Child SA Pre-Authentication - debian/patches/CVE-2026-78135.patch: ikev2: Properly reject CREATE_CHILD_SA requests on unestablished IKE_SAs in src/libcharon/sa/ikev2/task_manager_v2.c. - CVE-2026-78135 -- Marc Deslauriers <[email protected]> Wed, 09 Sep 2026 12:56:47 -0400 strongswan (6.0.7-1ubuntu2) stonking; urgency=medium * No-change rebuild against libssl4 -- Ravi Kant Sharma <[email protected]> Fri, 24 Jul 2026 11:21:33 +0000 strongswan (6.0.7-1ubuntu1) stonking; urgency=medium * Merge with Debian unstable (LP: #2154104). Remaining changes: - d/control: strongswan-starter hard-depends on strongswan-charon, therefore bump the dependency from Recommends to Depends. At the same time avoid a circular dependency by dropping strongswan-charon->strongswan-starter from Depends to Recommends as the binaries can work without the services but not vice versa. - Re-enable eap-{dynamic,peap} libcharon plugins (LP #1878887) + d/control: update libcharon-extra-plugins description. + d/libcharon-extra-plugins.install: install .so and conf files. + d/rules: add plugins to the configuration arguments. - d/t/{control,host-to-host,utils}: new host-to-host test (LP #1999525) - d/usr.sbin.swanctl: allow "m" flag for /usr/sbin/swanctl (LP #1999935) * Dropped changes [Fixed in 6.0.6-1]: - d/p/CVE-2026-35328.patch: prevent infinite loop if supported versions are too short in src/libtls/tls_server.c. - d/p/CVE-2026-35329.patch: avoid NULL pointer dereference when verifying padding in src/libstrongswan/crypto/pkcs5.c, src/libstrongswan/plugins/pkcs7/pkcs7_enveloped_data.c. - d/p/CVE-2026-35330.patch: reject zero-length EAP-SIM/AKA attributes in src/libsimaka/simaka_message.c. - d/p/CVE-2026-35331.patch: case-insensitive matching and reject excluded DN name constraints in src/libstrongswan/plugins/constraints/constraints_validator.c, src/libstrongswan/tests/suites/test_certnames.c. - d/p/CVE-2026-35332.patch: only accept non-empty ECDH public keys with TLS < 1.3 in src/libtls/tls_server.c. - d/p/CVE-2026-35333.patch: reject undersized attributes in enumerator in src/libradius/radius_message.c. - d/p/CVE-2026-35334.patch: avoid crash and timing leaks in PKCS#1 v1.5 decryption padding validation in src/libstrongswan/plugins/gmp/gmp_rsa_private_key.c, src/libstrongswan/utils/utils.h, src/libstrongswan/utils/utils/constant_time.h. - d/p/CVE-2026-25075.patch: prevent crash if AVP length header field is invalid in src/libcharon/plugins/eap_ttls/eap_ttls_avp.c. - d/p/CVE-2026-47895.patch: identification: Fix double-free when cloning empty IDs in src/libstrongswan/tests/suites/test_identification.c, src/libstrongswan/utils/identification.c -- Hector Cao <[email protected]> Tue, 30 Jun 2026 20:47:59 +0200 ** Affects: strongswan (Ubuntu) Importance: Wishlist Status: New ** Tags: needs-merge upgrade-software-version ** Changed in: strongswan (Ubuntu) Importance: Undecided => Wishlist ** Changed in: strongswan (Ubuntu) Milestone: None => ubuntu-27.01 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2171159 Title: Merge strongswan 6.1.0-2 from Debian for tenacious cycle To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/strongswan/+bug/2171159/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
