NEWS: Add info about CVE-2017-11185

diff --git a/NEWS b/NEWS
index 4033de1cb778cd1b7b8d13f1c724519458840140..8e82607b383d92c7c3b04f9bb0304f68601aac1d 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,15 @@
 strongswan-5.6.0
 ----------------
 
+- Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient
+  input validation when verifying RSA signatures, which requires decryption
+  with the operation m^e mod n, where m is the signature, and e and n are the
+  exponent and modulus of the public key.  The value m is an integer between
+  0 and n-1, however, the gmp plugin did not verify this.  So if m equals n the
+  calculation results in 0, in which case mpz_export() returns NULL.  This
+  result wasn't handled properly causing a null-pointer dereference.
+  This vulnerability has been registered as CVE-2017-11185.
+
 - New SWIMA IMC/IMV pair implements the "draft-ietf-sacm-nea-swima-patnc"
   Internet Draft and has been demonstrated at the IETF 99 Prague Hackathon.