strongSwan: update to 5.9.4

Release notes as per https://github.com/strongswan/strongswan/releases/tag/5.9.4:

    Fixed a denial-of-service vulnerability in the gmp plugin that was caused by an integer overflow when processing RSASSA-PSS signatures with very large salt lengths. This vulnerability has been registered as CVE-2021-41990.
    Please refer to our blog for details.
    Fixed a denial-of-service vulnerability in the in-memory certificate cache if certificates are replaced and a very large random value caused an integer overflow. This vulnerability has been registered as CVE-2021-41991.
    Please refer to our blog for details.
    Fixed a related flaw that caused the daemon to accept and cache an infinite number of versions of a valid certificate by modifying the parameters in the signatureAlgorithm field of the outer X.509 Certificate structure.
    AUTH_LIFETIME notifies are now only sent by a responder if it can't reauthenticate the IKE_SA itself due to asymmetric authentication (i.e. EAP) or the use of virtual IPs.
    Several corner cases with reauthentication have been fixed (48fbe1d, 36161fe, 0d373e2).
    Serial number generation in several pki sub-commands has been fixed so they don't start with an unintended zero byte (#631).
    Loading SSH public keys via vici has been improved (#467).
    Shared secrets, PEM files, vici messages, PF_KEY messages, swanctl configs and other data is properly wiped from memory.
    Use a longer dummy key to initialize HMAC instances in the openssl plugin in case it's used in FIPS-mode (#557).
    The --enable-tpm option now implies --enable-tss-tss2 as the plugin doesn't do anything without a TSS 2.0.
    libtpmtss is initialized in all programs and libraries that use it.
    Migrated testing scripts to Python 3.
    The testing environment uses images based on Debian bullseye by default (support for jessie was removed).

To my understanding, IPFire is not affected by CVE-2021-41990, as we do
not support creation of IPsec connections using RSASSA-PSS (please
correct me if we do :-). In contrast, CVE-2021-41991 affects IPFire
installations indeed.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

diff --git a/lfs/strongswan b/lfs/strongswan
index 46c0309fb21ae3fe89ebd2b207411a45a8cc80dd..45ff8f426f390f74a6623c941f6e7b362fc28f33 100644 (file)
--- a/lfs/strongswan
+++ b/lfs/strongswan
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 5.9.3
+VER        = 5.9.4
 
 THISAPP    = strongswan-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 80ecabe0ce72d550d2d5de0118f89143
+$(DL_FILE)_MD5 = 9c387eb77f0159fdefbcf7e81c905c35
 
 install : $(TARGET)