From ed839b3067566210484fbad879c7e8c9865c940b Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 24 Feb 2023 16:07:38 +0100 Subject: [PATCH] NEWS: Add info about CVE-2023-26463 --- NEWS | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/NEWS b/NEWS index 994518033..1a87c3c6a 100644 --- a/NEWS +++ b/NEWS @@ -1,6 +1,12 @@ strongswan-5.9.10 ----------------- +- Fixed a vulnerability related to certificate verification in TLS-based EAP + methods that leads to an authentication bypass followed by an expired pointer + dereference that results in a denial of service and possibly even remote code + execution. + This vulnerability has been registered as CVE-2023-26463. + - Added support for full packet hardware offload for IPsec SAs and policies with Linux 6.2 kernels to the kernel-netlink plugin.