ALT-PU-2022-4448-1
Package strongswan updated to version 5.9.5-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Published: 2022-01-31
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2021-45079
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
Severity: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
References: