From 2b19e517074b89af2b98440d132d4cdd8a8857dd Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 3 Jun 2015 12:33:58 +0200 Subject: [PATCH] NEWS: Add info about CVE-2015-4171 --- NEWS | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/NEWS b/NEWS index b2e8cb2e67..e0cfb7e98c 100644 --- a/NEWS +++ b/NEWS @@ -1,3 +1,13 @@ +strongswan-5.3.2 +---------------- + +- Fixed a vulnerability that allowed rogue servers with a valid certificate + accepted by the client to trick it into disclosing its username and even + password (if the client accepts EAP-GTC). This was caused because constraints + against the responder's authentication were enforced too late. + This vulnerability has been registered as CVE-2015-4171. + + strongswan-5.3.1 ---------------- -- 2.47.2