| Package | Affected versions | Patched versions |
|---|---|---|
| extra packages for enterprise linux | = 7.0= 8.0= 9.0 | |
| strongswan | ≥ 4.1.2, < 5.9.5 | 5.9.5 |
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free