Arch Linux Security Advisory ASA-201802-10 ========================================== Severity: Medium Date : 2018-02-21 CVE-ID : CVE-2018-6459 Package : strongswan Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-625 Summary ======= The package strongswan before version 5.6.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 5.6.2-1. # pacman -Syu "strongswan>=5.6.2-1" The problem has been fixed upstream in version 5.6.2. Workaround ========== None. Description =========== The rsa_pss_params_parse function in libstrongswan/credentials/keys/signature_params.c before strongSwan 5.6.2 allows remote attackers to cause a denial of service via a crafted RSASSA-PSS signature that lacks a mask generation function parameter. Impact ====== A remote attacker is able to crash the application by providing a maliciously-crafted signature. References ========== https://bugs.archlinux.org/task/57597 https://www.strongswan.org/blog/2018/02/19/strongswan-vulnerability-(cve-201... https://download.strongswan.org/security/CVE-2018-6459/strongswan-5.6.1_pss_... https://github.com/strongswan/strongswan/commit/40da179f28b768ffcf6ff7e2f686... https://security.archlinux.org/CVE-2018-6459