diff options
| author | zi <zi@FreeBSD.org> | 2014-05-04 20:43:27 +0800 |
|---|---|---|
| committer | zi <zi@FreeBSD.org> | 2014-05-04 20:43:27 +0800 |
| commit | 7cfcd2896bb7974934ba99a5ce3abfeb2db656ce (patch) | |
| tree | e03692a6d7323c593108850ce82ad68ddfca647d /security | |
| parent | 7d96e14e512244febf31882e4dedff361dcb2f11 (diff) | |
| download | freebsd-ports-gnome-7cfcd2896bb7974934ba99a5ce3abfeb2db656ce.tar.gz freebsd-ports-gnome-7cfcd2896bb7974934ba99a5ce3abfeb2db656ce.tar.zst freebsd-ports-gnome-7cfcd2896bb7974934ba99a5ce3abfeb2db656ce.zip | |
- Document strongSwan vulnerability (CVE-2014-2338)
- Add additional reminder to document port variants
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 34 |
1 files changed, 33 insertions, 1 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 11145de6b625..240035aa2f79 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -51,10 +51,42 @@ a new entry is available in The Porter's Handbook at: Help is also available from ports-security@freebsd.org. -Note: Please add new entries to the beginning of this file. +Notes: + * Please add new entries to the beginning of this file. + * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="6fb521b0-d388-11e3-a790-000c2980a9f3"> + <topic>strongswan -- Remote Authentication Bypass</topic> + <affects> + <package> + <name>strongswan</name> + <range><lt>5.1.3</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>strongSwan developers report:</p> + <blockquote cite="www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-(cve-2014-2338).html"> + <p>Remote attackers are able to bypass authentication by rekeying an + IKE_SA during (1) initiation or (2) re-authentication, which + triggers the IKE_SA state to be set to established.</p> + <p>Only installations that actively initiate or re-authenticate IKEv2 + IKE_SAs are affected.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2014-2338</cvename> + <url>http://www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-%28cve-2014-2338%29.html</url> + </references> + <dates> + <discovery>2014-03-12</discovery> + <entry>2014-05-04</entry> + </dates> + </vuln> + <vuln vid="670d732a-cdd4-11e3-aac2-0022fb6fcf92"> <topic>mohawk -- multiple vulnerabilities</topic> <affects> |