[rpms/strongswan] rawhide: - Update to 6.1.0 for various CVEs and default disabling of IKEv1

[rpms/strongswan] rawhide: - Update to 6.1.0 for various CVEs and default disabling of IKEv1

[Paul Wouters]

            A new commit has been pushed.

            Repo   : rpms/strongswan
            Branch : rawhide
            Commit : dc635f844705c27cec607bf8eee5bef53689ace4
            Author : Paul Wouters <paul.wouters@aiven.io>
            Date   : 2026-09-21T13:45:06-04:00
            Stats  : +7/-4 in 3 file(s)
            URL    : https://src.fedoraproject.org/rpms/strongswan/c/dc635f844705c27cec607bf8eee5bef53689ace4?branch=rawhide

            Log:
            - Update to 6.1.0 for various CVEs and default disabling of IKEv1

CVE-2026-78123 - Fixed a vulnerability in the openssl plugin related
to the processing of PKCS#7 containers that can result in a crash.
Affects 5.0.2 and newer.

CVE-2026-78124 - Fixed a vulnerability in the openssl plugin related
to the enumeration of certificates in PKCS#7 containers that can result
in memory leaks. Affects 5.0.2 and newer.

CVE-2026-78126 - Fixed a vulnerability in the eap-aka plugin related
to processing an unexpected AKA-Synchronization-Failure that can result
in a crash. Affects 4.1.10 and newer.

CVE-2026-78127 - Fixed a vulnerability in libcharon related to the
logging of IKE messages that can result in a denial of service via
memory exhaustion. Affects 4.1.2 and newer.

CVE-2026-78129 - Fixed a vulnerability in libstrongswan related to
the processing of encrypted PKCS#7 containers that can result in a
denial of service. Affects 4.6.2 and newer.

CVE-2026-78130 - Fixed a vulnerability in the x509 plugin related to
the verification of X.509 attribute certificates that can lead to a
denial of service. Affects 4.2.0 and newer.

CVE-2026-78131 - Fixed a vulnerability in the x509 plugin related to
the parsing of identities in X.509 attribute certificates that can lead
to a denial of service via memory exhaustion. Affects 4.2.0 and newer.

CVE-2026-78132 - Fixed a vulnerability in the x509 plugin related to
the parsing of the ietfAttrSyntax ASN.1 type in X.509 attribute
certificates that can lead to a denial of service. Affects 5.1.3 and
newer.

CVE-2026-78133 - Fixed a vulnerability in libcharon related to the
handling of IKEv2 rekeying collisions that can result in a
use-after-free and potentially remote code execution. Affects 6.0.0 and
newer.

CVE-2026-78134 - Fixed a vulnerability in the eap-peap and eap-ttls
plugins related to the propagation of authentication details from inner
EAP methods that can result in incorrect identity binding and potential
authorization bypass. Affects 4.5.0 and newer.

CVE-2026-78135 - Fixed a vulnerability in libcharon related to the
handling of CREATE_CHILD_SA requests on unestablished IKE SAs that can
result in the creation of a usable Child SA before authentication
completes. Affects 5.9.7 and newer.

---
diff --git a/.gitignore b/.gitignore
index 30c9adf..9da440a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,3 +27,5 @@
 /strongswan-6.0.6.tar.bz2.sig
 /strongswan-6.0.7.tar.bz2
 /strongswan-6.0.7.tar.bz2.sig
+/strongswan-6.1.0.tar.bz2
+/strongswan-6.1.0.tar.bz2.sig

diff --git a/sources b/sources
index 24ba990..ebb51bd 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (strongswan-6.0.7.tar.bz2) = 1d10b0eaf39072db1d7f5237661e71c81107bb0bdea6a4bcbdff0c54eb7f72d6487f78c91a6f527c69ff20f9ee611d7e8cedcec4c5cc65d53ecc4301e1353240
-SHA512 (strongswan-6.0.7.tar.bz2.sig) = 3206fa1c8e5457252734f7bf1254ff70f1ccf0d9541f978e9daa8b9d6dee4bf240fdce64df50967781068138b60f30ff220e3e8f118989c55fac6c0ff5882ecf
+SHA512 (strongswan-6.1.0.tar.bz2) = 01cea929cea2535751b5ef23eddc780a3c32ffafee640a6d5cea9a52798d0ec7030107463e8ddcc73fd0924b378a8676942297a42d79319207ecf7716badcb5f
+SHA512 (strongswan-6.1.0.tar.bz2.sig) = 9735a5e9032e7c05bc1e8b9cc30378a0f82c52a62b5c4718be827b27d227d34b81f0fe7af0bcca9ca12162ee98a521f285a7280d7573362d8196eb56a7d1e266

diff --git a/strongswan.spec b/strongswan.spec
index e10c3cc..d059a74 100644
--- a/strongswan.spec
+++ b/strongswan.spec
@@ -10,7 +10,7 @@
 %global forgeurl0 https://github.com/strongswan/strongswan
 
 Name:           strongswan
-Version:        6.0.7
+Version:        6.1.0
 Release:        %autorelease
 Summary:        An OpenSource IPsec-based VPN and TNC solution
 # Automatically converted from old format: GPLv2+ - review is highly recommended.
@@ -25,7 +25,8 @@ Source3:        tmpfiles-strongswan.conf
 Patch1:         strongswan-5.9.7-error-no-format.patch
 # Use isolation to prevent pip attempting to download during build
 Patch2:         strongswan-6.0.2-no-isolation.patch
-Patch3:         strongswan-mldsa.patch
+# needs updating for 6.1.0
+# Patch3:         strongswan-mldsa.patch
 
 BuildRequires:  autoconf
 BuildRequires:  automake