CVE-2015-4171

EPSS 1.0%

strongswan - security update

發布日:2015/6/10修改日:2026/3/9

也稱為:DSA-3282-1DEBIAN-CVE-2015-4171DLA-244-1

描述

strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.

受影響套件(3)

Debian/strongswanfrom 0, < 5.3.1-1
Debian/strongswanfrom 0, < 4.4.1-5.7
Debian/strongswanfrom 0, < 4.5.2-1.5+deb7u7

參考連結(1)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2015-4171