diff options
Diffstat (limited to 'NEWS')
| -rw-r--r-- | NEWS | 13 |
1 files changed, 13 insertions, 0 deletions
@@ -1,3 +1,16 @@ +strongswan-4.2.15 +----------------- + +- Fixed two DoS vulnerabilities in the charon daemon that were discovered by + fuzzing techniques: 1) Sending a malformed IKE_SA_INIT request leaved an + incomplete state which caused a null pointer dereference if a subsequent + CREATE_CHILD_SA request was sent. 2) Sending an IKE_AUTH request with either + a missing TSi or TSr payload caused a null pointer derefence because the + checks for TSi and TSr were interchanged. The IKEv2 fuzzer used was + developped by the Orange Labs vulnerability research team. The tool was + initially written by Gabriel Campana and is now maintained by Laurent Butti. + + strongswan-4.2.14 ----------------- |