public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Paul Wouters <paul.wouters@aiven.io>
To: git-commits@fedoraproject.org
Subject: [rpms/strongswan] rawhide: - Update to 6.1.0 for various CVEs and default disabling of IKEv1
Date: Mon, 21 Sep 2026 17:47:00 GMT [thread overview]
Message-ID: <179001282061.1.10800240437072947368.rpms-strongswan-dc635f844705@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : rpms/strongswan
Branch : rawhide
Commit : dc635f844705c27cec607bf8eee5bef53689ace4
Author : Paul Wouters <paul.wouters@aiven.io>
Date : 2026-09-21T13:45:06-04:00
Stats : +7/-4 in 3 file(s)
URL : https://src.fedoraproject.org/rpms/strongswan/c/dc635f844705c27cec607bf8eee5bef53689ace4?branch=rawhide
Log:
- Update to 6.1.0 for various CVEs and default disabling of IKEv1
CVE-2026-78123 - Fixed a vulnerability in the openssl plugin related
to the processing of PKCS#7 containers that can result in a crash.
Affects 5.0.2 and newer.
CVE-2026-78124 - Fixed a vulnerability in the openssl plugin related
to the enumeration of certificates in PKCS#7 containers that can result
in memory leaks. Affects 5.0.2 and newer.
CVE-2026-78126 - Fixed a vulnerability in the eap-aka plugin related
to processing an unexpected AKA-Synchronization-Failure that can result
in a crash. Affects 4.1.10 and newer.
CVE-2026-78127 - Fixed a vulnerability in libcharon related to the
logging of IKE messages that can result in a denial of service via
memory exhaustion. Affects 4.1.2 and newer.
CVE-2026-78129 - Fixed a vulnerability in libstrongswan related to
the processing of encrypted PKCS#7 containers that can result in a
denial of service. Affects 4.6.2 and newer.
CVE-2026-78130 - Fixed a vulnerability in the x509 plugin related to
the verification of X.509 attribute certificates that can lead to a
denial of service. Affects 4.2.0 and newer.
CVE-2026-78131 - Fixed a vulnerability in the x509 plugin related to
the parsing of identities in X.509 attribute certificates that can lead
to a denial of service via memory exhaustion. Affects 4.2.0 and newer.
CVE-2026-78132 - Fixed a vulnerability in the x509 plugin related to
the parsing of the ietfAttrSyntax ASN.1 type in X.509 attribute
certificates that can lead to a denial of service. Affects 5.1.3 and
newer.
CVE-2026-78133 - Fixed a vulnerability in libcharon related to the
handling of IKEv2 rekeying collisions that can result in a
use-after-free and potentially remote code execution. Affects 6.0.0 and
newer.
CVE-2026-78134 - Fixed a vulnerability in the eap-peap and eap-ttls
plugins related to the propagation of authentication details from inner
EAP methods that can result in incorrect identity binding and potential
authorization bypass. Affects 4.5.0 and newer.
CVE-2026-78135 - Fixed a vulnerability in libcharon related to the
handling of CREATE_CHILD_SA requests on unestablished IKE SAs that can
result in the creation of a usable Child SA before authentication
completes. Affects 5.9.7 and newer.
---
diff --git a/.gitignore b/.gitignore
index 30c9adf..9da440a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,3 +27,5 @@
/strongswan-6.0.6.tar.bz2.sig
/strongswan-6.0.7.tar.bz2
/strongswan-6.0.7.tar.bz2.sig
+/strongswan-6.1.0.tar.bz2
+/strongswan-6.1.0.tar.bz2.sig
diff --git a/sources b/sources
index 24ba990..ebb51bd 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (strongswan-6.0.7.tar.bz2) = 1d10b0eaf39072db1d7f5237661e71c81107bb0bdea6a4bcbdff0c54eb7f72d6487f78c91a6f527c69ff20f9ee611d7e8cedcec4c5cc65d53ecc4301e1353240
-SHA512 (strongswan-6.0.7.tar.bz2.sig) = 3206fa1c8e5457252734f7bf1254ff70f1ccf0d9541f978e9daa8b9d6dee4bf240fdce64df50967781068138b60f30ff220e3e8f118989c55fac6c0ff5882ecf
+SHA512 (strongswan-6.1.0.tar.bz2) = 01cea929cea2535751b5ef23eddc780a3c32ffafee640a6d5cea9a52798d0ec7030107463e8ddcc73fd0924b378a8676942297a42d79319207ecf7716badcb5f
+SHA512 (strongswan-6.1.0.tar.bz2.sig) = 9735a5e9032e7c05bc1e8b9cc30378a0f82c52a62b5c4718be827b27d227d34b81f0fe7af0bcca9ca12162ee98a521f285a7280d7573362d8196eb56a7d1e266
diff --git a/strongswan.spec b/strongswan.spec
index e10c3cc..d059a74 100644
--- a/strongswan.spec
+++ b/strongswan.spec
@@ -10,7 +10,7 @@
%global forgeurl0 https://github.com/strongswan/strongswan
Name: strongswan
-Version: 6.0.7
+Version: 6.1.0
Release: %autorelease
Summary: An OpenSource IPsec-based VPN and TNC solution
# Automatically converted from old format: GPLv2+ - review is highly recommended.
@@ -25,7 +25,8 @@ Source3: tmpfiles-strongswan.conf
Patch1: strongswan-5.9.7-error-no-format.patch
# Use isolation to prevent pip attempting to download during build
Patch2: strongswan-6.0.2-no-isolation.patch
-Patch3: strongswan-mldsa.patch
+# needs updating for 6.1.0
+# Patch3: strongswan-mldsa.patch
BuildRequires: autoconf
BuildRequires: automake
reply other threads:[~2026-09-21 17:47 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=179001282061.1.10800240437072947368.rpms-strongswan-dc635f844705@fedoraproject.org \
--to=paul.wouters@aiven.io \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox