Hi Yves-Alexis, On 10/31/26 05:34, Yves-Alexis Perez wrote:
Hey Simon, thanks for the work. I'll try to take a look but if you don't hear back from me it's an ok from me to upload.
Sounds good, thank you!
On Thu, 2026-10-29 at 11:27 -0500, Simon Quigley wrote:I built this in a Bookworm schroot. Against strongswan 5.9.8-5+deb12u5 from the archive, the PKCS#7 and attribute-certificate bugs still fire, EAP-AKA still crashes, a huge PKCS#5 iteration count still stalls, the IKE log still leaks, EAP-TTLS still keeps the outer identity, and a CREATE_CHILD_SA during EAP still installs a Child SA. None of that happens with 5.9.8-5+deb12u6.How did you test the various bugs firing?
I built deb12u5 and deb12u6 with ASan in a Bookworm container, then looked at each CVE directly; a small harness linked against libstrongswan for the library bugs, and a couple of Python IKE peers in separate network namespaces for the charon ones. On deb12u5, the PKCS#7 SKI signature check segfaults, the PKCS#7 cert enumerator and the AC directoryName parser leak, EAP-AKA null-derefs on a resync before any challenge, a PBKDF2 count of 2,000,000 stalls the key load for seconds, the IKE log enumerator leaks on every oversized message, an AC with no issuer crashes issued_by/has_issuer, and a malformed ietfAttrSyntax hangs the parser. On the charon side, EAP-TTLS binds the SA to the outer identity instead of the inner one, and a CREATE_CHILD_SA sent mid-EAP installs a Child SA while the IKE SA is still connecting. None of those CVEs are reproducible on deb12u6. make check is clean on both, and a normal connection still comes up.
The package test suite is clean on both versions, and a normal connection still comes up. Here is my Salsa fork: https://salsa.debian.org/tsimonq2/strongswan/-/tree/debian/bookwormCould you open a merge request against the main package? That way we'll be able to maintain a single repository.
I have access to be able to merge manually, but done: https://salsa.debian.org/debian/strongswan/-/merge_requests/15
Here is the Debusine work request: https://debusine.debian.net/debian/developers/work-request/1558827/ Feedback is welcome. If nothing showstopping comes up, I'll upload this and issue the DLA on Monday morning (November 2nd, 2026).Regards,
Best regards, Simon Quigley [email protected]
OpenPGP_signature.asc
Description: OpenPGP digital signature
