Summary
Xu Biang discovered that the strongSwan client incorrectly handled
EAP-MSCHAPv2 failure requests. If a user or automated system were tricked
into connecting to a malicious server, a remote attacker could use this
issue to cause strongSwan to crash, resulting in a denial of service, or
possibly execute arbitrary code.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | strongswan | 5.9.5-2ubuntu2.4 |
| Ubuntu · 24.04 LTS 24.04:LTS | strongswan | 5.9.13-2ubuntu4.24.04.1 |
| Ubuntu · 25.10 | strongswan | 6.0.1-6ubuntu4.1 |
Vulnerabilities 1
-
High 8.1
In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted…
References
-
report
https://ubuntu.com/security/CVE-2025-62291