CVE-2015-8023
strongswan - security update
EPSS 0.80%
Description
The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.
How to fix CVE-2015-8023
To remediate CVE-2015-8023, upgrade the affected package to a fixed version below.
- Debian/strongswan—upgrade to 5.3.3-3 or later
- Debian/strongswan—upgrade to 4.4.1-5.8 or later
- —upgrade to 4.5.2-1.5+deb7u8 or later
Is CVE-2015-8023 being exploited?
Low — EPSS is 0.8%, meaning exploitation activity has not been observed at scale.
Affected packages (3)
- from 0, < 5.3.3-3
- from 0, < 4.4.1-5.8
- from 0, < 4.5.2-1.5+deb7u8