Blog

Release and vulnerability announcements for strongSwan

We are happy to announce the release of strongSwan 5.7.2, which brings automatic signature scheme selection for TPM 2.0, updates for RADIUS and crypto plugins, dynamic paths for swanctl, and several other new features and fixes.

strongSwan 5.7.1 fixes a denial-of-service vulnerability in last week's 5.7.0 release and the patch for the vulnerability that was fixed with it.

A denial-of-service vulnerability in the gmp plugin was discovered in strongSwan. All versions patched with the fix for CVE-2018-16151/2 are affected.

A potential authorization bypass vulnerability in the gmp plugin was discovered in strongSwan. All versions are affected in certain configurations.

We are happy to announce the release of strongSwan 5.7.0, which brings support for SWIMA for PA-TNC, swanctl.conf/strongswan.conf syntax changes, a Botan crypto library plugin, support for Postquantum Preshared Keys for IKEv2, fixes a potential authorization bypass vulnerability, and comes with several other new features and fixes.

We are happy to announce the release of strongSwan 5.6.3, which improves certificate chain validation, updates the DHCP plugin, allows forcing the local termination of IKE_SAs, supports trap policies with virtual IPs, and fixes two potential DoS vulnerabilities and several other issues.

A denial-of-service vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS mode and HMAC-MD5 is negotiated as PRF was discovered, all strongSwan versions since 5.0.1 may be affected.

A denial-of-service vulnerability in the stroke plugin was discovered in strongSwan. All versions are affected in certain configurations.