p PatchFirst

CVE-2015-8023

CVE-2015-8023

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.

EPSS 2.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • strongswan Debian:12

    Affected ranges
    • ECOSYSTEM: < 5.3.3-3

    Update to 5.3.3-3

  • strongswan Debian:13

    Affected ranges
    • ECOSYSTEM: < 5.3.3-3

    Update to 5.3.3-3

  • strongswan Debian:14

    Affected ranges
    • ECOSYSTEM: < 5.3.3-3

    Update to 5.3.3-3

  • strongswan Ubuntu:14.04:LTS

    Versions
    • 4.6.4-9
    • 5.1.0-2
    • 5.1.0-3
    • 5.1.1-0ubuntu1
    • 5.1.1-0ubuntu2
    • 5.1.1-0ubuntu3
    • 5.1.1-0ubuntu4
    • 5.1.1-0ubuntu5
    • 5.1.1-0ubuntu7
    • 5.1.1-0ubuntu14
    • 5.1.1-0ubuntu17
    • 5.1.2~dr3+git20130120-0ubuntu2
    • 5.1.2~dr3+git20130120-0ubuntu3
    • 5.1.2~rc1-0ubuntu3
    • 5.1.2~rc1-0ubuntu4
    • 5.1.2~rc2-0ubuntu2
    • 5.1.2-0ubuntu1
    • 5.1.2-0ubuntu2
    • 5.1.2-0ubuntu2.2
    • 5.1.2-0ubuntu2.3
    Affected ranges
    • ECOSYSTEM: < 5.1.2-0ubuntu2.4

    Update to 5.1.2-0ubuntu2.4

  • strongswan Ubuntu:16.04:LTS

    Versions
    • 5.1.2-0ubuntu6
    Affected ranges
    • ECOSYSTEM: < 5.1.2-0ubuntu7

    Update to 5.1.2-0ubuntu7

Original sources

Check your server →