NEWS: Add info about CVE-2021-45079

diff --git a/NEWS b/NEWS
index 3fee3763a94954566a3199ca0ef23dd79be528ad..d4bb926d43800c37e5272a188873641a7c7ac26c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,12 @@
 strongswan-5.9.5
 ----------------
 
+- Fixed a vulnerability in the EAP client implementation that was caused by
+  incorrectly handling early EAP-Success messages. It may allow to bypass the
+  client and in some scenarios even the server authentication, or could lead to
+  a denial-of-service attack.
+  This vulnerability has been registered as CVE-2021-45079.
+
 - Using the trusted RSA or ECC Endorsement Key of the TPM 2.0, libtpmtss may now
   establish a secure session via RSA encryption or an ephemeral ECDH key
   exchange, respectively. The session allows HMAC-based authenticated