Version in base suite: 5.9.8-5+deb12u4 Base version: strongswan_5.9.8-5+deb12u4 Target version: strongswan_5.9.8-5+deb12u5 Base file: /srv/ftp-master.debian.org/ftp/pool/main/s/strongswan/strongswan_5.9.8-5+deb12u4.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/s/strongswan/strongswan_5.9.8-5+deb12u5.dsc changelog | 6 patches/0016-identification-Fix-double-free-when-cloning-empty-ID.patch | 86 ++++++++++ patches/series | 1 po/cs.po | 2 po/da.po | 2 po/de.po | 2 po/es.po | 2 po/eu.po | 2 po/fi.po | 2 po/fr.po | 2 po/gl.po | 2 po/it.po | 2 po/ja.po | 2 po/nb.po | 2 po/nl.po | 2 po/pl.po | 2 po/pt.po | 2 po/pt_BR.po | 2 po/ru.po | 2 po/sv.po | 2 po/templates.pot | 2 po/tr.po | 2 po/vi.po | 2 23 files changed, 113 insertions(+), 20 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpk1_3bb00/strongswan_5.9.8-5+deb12u4.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpk1_3bb00/strongswan_5.9.8-5+deb12u5.dsc: no acceptable signature found diff -Nru strongswan-5.9.8/debian/changelog strongswan-5.9.8/debian/changelog --- strongswan-5.9.8/debian/changelog 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/changelog 2026-05-27 06:58:30.000000000 +0000 @@ -1,3 +1,9 @@ +strongswan (5.9.8-5+deb12u5) bookworm-security; urgency=medium + + * d/patches: add fix for double-free when cloning empty IDs (CVE-2026-47895) + + -- Yves-Alexis Perez Wed, 27 May 2026 08:58:30 +0200 + strongswan (5.9.8-5+deb12u4) bookworm-security; urgency=medium * d/patches: add fix for integer underflow in libsimaka when handling diff -Nru strongswan-5.9.8/debian/patches/0016-identification-Fix-double-free-when-cloning-empty-ID.patch strongswan-5.9.8/debian/patches/0016-identification-Fix-double-free-when-cloning-empty-ID.patch --- strongswan-5.9.8/debian/patches/0016-identification-Fix-double-free-when-cloning-empty-ID.patch 1970-01-01 00:00:00.000000000 +0000 +++ strongswan-5.9.8/debian/patches/0016-identification-Fix-double-free-when-cloning-empty-ID.patch 2026-05-27 06:58:30.000000000 +0000 @@ -0,0 +1,86 @@ +From: "R. Elliott Childre" +Date: Mon, 18 May 2026 00:53:24 -0400 +Subject: identification: Fix double-free when cloning empty IDs + +The clone() method was missing a branch when there is an encoded chunk +of length 0 that still needed to be cloned. Otherwise, the destruction +of the clone frees the same pointer that the original owns. + +This double free was found with an improved `fuzz_ids` fuzz harness and +a two byte input to create an identification from "@#" or [0x40, 0x23]. +It can also be triggered with `:#` e.g. `dns:#`. + +One of the problematic constructors is used to parse EAP-Identities, +which are cloned before storing them in the auth-cfg. So this can be +triggered by an unauthenticated attacker. + +Note that while the length check was already added with 418dbd624363 +("cloning %any ID without zero-byte memleak") and identities that trigger +this can be created since 86ab5636c2c9 ("support for @#hex ID_KEY_ID +identification_t"), it was the referenced commit that made the length +check problematic. + +Fixes: 2147da40a5d7 ("simplified identification_t.clone() using memcpy") +Fixes: CVE-2026-47895 +--- + .../tests/suites/test_identification.c | 23 ++++++++++++++++++++++ + src/libstrongswan/utils/identification.c | 5 +---- + 2 files changed, 24 insertions(+), 4 deletions(-) + +diff --git a/src/libstrongswan/tests/suites/test_identification.c b/src/libstrongswan/tests/suites/test_identification.c +index eac6b55..5a3bb55 100644 +--- a/src/libstrongswan/tests/suites/test_identification.c ++++ b/src/libstrongswan/tests/suites/test_identification.c +@@ -1172,6 +1172,28 @@ START_TEST(test_clone) + } + END_TEST + ++START_TEST(test_clone_empty) ++{ ++ identification_t *a, *b; ++ chunk_t a_enc, b_enc; ++ ++ /* this produces an empty but non-NULL encoding, which previously caused a ++ * double-free when destroying a clone */ ++ a = identification_create_from_string("@#"); ++ ck_assert(a != NULL); ++ a_enc = a->get_encoding(a); ++ ++ b = a->clone(a); ++ ck_assert(b != NULL); ++ ck_assert(a != b); ++ b_enc = b->get_encoding(b); ++ ck_assert(a_enc.ptr != b_enc.ptr); ++ ++ b->destroy(b); ++ a->destroy(a); ++} ++END_TEST ++ + Suite *identification_suite_create() + { + Suite *s; +@@ -1227,6 +1249,7 @@ Suite *identification_suite_create() + + tc = tcase_create("clone"); + tcase_add_test(tc, test_clone); ++ tcase_add_test(tc, test_clone_empty); + suite_add_tcase(s, tc); + + return s; +diff --git a/src/libstrongswan/utils/identification.c b/src/libstrongswan/utils/identification.c +index 6ddaf6c..d2c8fc2 100644 +--- a/src/libstrongswan/utils/identification.c ++++ b/src/libstrongswan/utils/identification.c +@@ -1335,10 +1335,7 @@ METHOD(identification_t, clone_, identification_t*, + private_identification_t *clone = malloc_thing(private_identification_t); + + memcpy(clone, this, sizeof(private_identification_t)); +- if (this->encoded.len) +- { +- clone->encoded = chunk_clone(this->encoded); +- } ++ clone->encoded = chunk_clone(this->encoded); + return &clone->public; + } + diff -Nru strongswan-5.9.8/debian/patches/series strongswan-5.9.8/debian/patches/series --- strongswan-5.9.8/debian/patches/series 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/patches/series 2026-05-27 06:58:30.000000000 +0000 @@ -13,3 +13,4 @@ 0013-pkcs5-pkcs7-Avoid-NULL-pointer-dereference-when-veri.patch 0014-constraints-Case-insensitive-matching-and-reject-exc.patch 0015-gmp-Avoid-crash-and-timing-leaks-in-PKCS-1-v1.5-decr.patch +0016-identification-Fix-double-free-when-cloning-empty-ID.patch diff -Nru strongswan-5.9.8/debian/po/cs.po strongswan-5.9.8/debian/po/cs.po --- strongswan-5.9.8/debian/po/cs.po 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/cs.po 2026-05-27 06:58:30.000000000 +0000 @@ -13,7 +13,7 @@ msgstr "" "Project-Id-Version: strongswan\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: 2013-10-28 14:42+0100\n" "Last-Translator: Miroslav Kure \n" "Language-Team: Czech \n" diff -Nru strongswan-5.9.8/debian/po/da.po strongswan-5.9.8/debian/po/da.po --- strongswan-5.9.8/debian/po/da.po 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/da.po 2026-05-27 06:58:30.000000000 +0000 @@ -7,7 +7,7 @@ msgstr "" "Project-Id-Version: strongswan\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: 2013-10-06 12:42+0000\n" "Last-Translator: Joe Hansen \n" "Language-Team: Danish \n" diff -Nru strongswan-5.9.8/debian/po/de.po strongswan-5.9.8/debian/po/de.po --- strongswan-5.9.8/debian/po/de.po 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/de.po 2026-05-27 06:58:30.000000000 +0000 @@ -8,7 +8,7 @@ msgstr "" "Project-Id-Version: strongswan 4.4.0-1\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: 2013-11-02 15:40+0100\n" "Last-Translator: Helge Kreutzmann \n" "Language-Team: German \n" diff -Nru strongswan-5.9.8/debian/po/es.po strongswan-5.9.8/debian/po/es.po --- strongswan-5.9.8/debian/po/es.po 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/es.po 2026-05-27 06:58:30.000000000 +0000 @@ -31,7 +31,7 @@ msgstr "" "Project-Id-Version: strongswan 4.4.1-5\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: 2013-12-17 17:19-0300\n" "Last-Translator: Matías Bellone \n" "Language-Team: Debian l10n Spanish \n" diff -Nru strongswan-5.9.8/debian/po/eu.po strongswan-5.9.8/debian/po/eu.po --- strongswan-5.9.8/debian/po/eu.po 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/eu.po 2026-05-27 06:58:30.000000000 +0000 @@ -8,7 +8,7 @@ msgstr "" "Project-Id-Version: strongswan_4.4.1-5.1_eu\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: 2013-10-15 21:41+0200\n" "Last-Translator: Iñaki Larrañaga Murgoitio \n" "Language-Team: Basque \n" diff -Nru strongswan-5.9.8/debian/po/fi.po strongswan-5.9.8/debian/po/fi.po --- strongswan-5.9.8/debian/po/fi.po 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/fi.po 2026-05-27 06:58:30.000000000 +0000 @@ -6,7 +6,7 @@ msgstr "" "Project-Id-Version: strongswan\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: 2009-05-25 14:49+0100\n" "Last-Translator: Esko Arajärvi \n" "Language-Team: Finnish \n" diff -Nru strongswan-5.9.8/debian/po/fr.po strongswan-5.9.8/debian/po/fr.po --- strongswan-5.9.8/debian/po/fr.po 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/fr.po 2026-05-27 06:58:30.000000000 +0000 @@ -7,7 +7,7 @@ msgstr "" "Project-Id-Version: strongswan\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: 2010-06-24 22:17+0200\n" "Last-Translator: Christian Perrier \n" "Language-Team: French \n" diff -Nru strongswan-5.9.8/debian/po/gl.po strongswan-5.9.8/debian/po/gl.po --- strongswan-5.9.8/debian/po/gl.po 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/gl.po 2026-05-27 06:58:30.000000000 +0000 @@ -6,7 +6,7 @@ msgstr "" "Project-Id-Version: templates_[kI6655]\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: 2009-05-25 14:50+0100\n" "Last-Translator: marce villarino \n" "Language-Team: Galician \n" diff -Nru strongswan-5.9.8/debian/po/it.po strongswan-5.9.8/debian/po/it.po --- strongswan-5.9.8/debian/po/it.po 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/it.po 2026-05-27 06:58:30.000000000 +0000 @@ -7,7 +7,7 @@ msgstr "" "Project-Id-Version: strongswan\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: 2013-11-09 13:41+0200\n" "Last-Translator: Beatrice Torracca \n" "Language-Team: Italian \n" diff -Nru strongswan-5.9.8/debian/po/ja.po strongswan-5.9.8/debian/po/ja.po --- strongswan-5.9.8/debian/po/ja.po 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/ja.po 2026-05-27 06:58:30.000000000 +0000 @@ -16,7 +16,7 @@ msgstr "" "Project-Id-Version: strongswan 4.4.1-4\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: 2013-02-07 21:28+0900\n" "Last-Translator: Hideki Yamane \n" "Language-Team: Japanese \n" diff -Nru strongswan-5.9.8/debian/po/nb.po strongswan-5.9.8/debian/po/nb.po --- strongswan-5.9.8/debian/po/nb.po 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/nb.po 2026-05-27 06:58:30.000000000 +0000 @@ -6,7 +6,7 @@ msgstr "" "Project-Id-Version: nb\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: 2013-10-06 17:37+0200\n" "Last-Translator: Bjørn Steensrud \n" "Language-Team: Norwegian Bokmål \n" diff -Nru strongswan-5.9.8/debian/po/nl.po strongswan-5.9.8/debian/po/nl.po --- strongswan-5.9.8/debian/po/nl.po 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/nl.po 2026-05-27 06:58:30.000000000 +0000 @@ -10,7 +10,7 @@ msgstr "" "Project-Id-Version: strongswan 4.5.0-1\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: 2014-09-24 18:39+0200\n" "Last-Translator: Frans Spiesschaert \n" "Language-Team: Debian Dutch l10n Team \n" diff -Nru strongswan-5.9.8/debian/po/pl.po strongswan-5.9.8/debian/po/pl.po --- strongswan-5.9.8/debian/po/pl.po 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/pl.po 2026-05-27 06:58:30.000000000 +0000 @@ -6,7 +6,7 @@ msgstr "" "Project-Id-Version: \n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: 2012-01-31 15:36+0100\n" "Last-Translator: Michał Kułach \n" "Language-Team: Polish \n" diff -Nru strongswan-5.9.8/debian/po/pt.po strongswan-5.9.8/debian/po/pt.po --- strongswan-5.9.8/debian/po/pt.po 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/pt.po 2026-05-27 06:58:30.000000000 +0000 @@ -8,7 +8,7 @@ msgstr "" "Project-Id-Version: strongswan 5.1.0-3\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: 2013-11-18 00:33+0000\n" "Last-Translator: Américo Monteiro \n" "Language-Team: Portuguese \n" diff -Nru strongswan-5.9.8/debian/po/pt_BR.po strongswan-5.9.8/debian/po/pt_BR.po --- strongswan-5.9.8/debian/po/pt_BR.po 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/pt_BR.po 2026-05-27 06:58:30.000000000 +0000 @@ -9,7 +9,7 @@ msgstr "" "Project-Id-Version: strongswan 5.1.3-4\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: 2014-06-25 18:13-0300\n" "Last-Translator: Adriano Rafael Gomes \n" "Language-Team: Brazilian Portuguese \n" "Language-Team: Russian \n" diff -Nru strongswan-5.9.8/debian/po/sv.po strongswan-5.9.8/debian/po/sv.po --- strongswan-5.9.8/debian/po/sv.po 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/sv.po 2026-05-27 06:58:30.000000000 +0000 @@ -8,7 +8,7 @@ msgstr "" "Project-Id-Version: strongswan_sv\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: 2013-10-07 09:05+0100\n" "Last-Translator: Martin Bagge / brother \n" "Language-Team: Swedish \n" diff -Nru strongswan-5.9.8/debian/po/templates.pot strongswan-5.9.8/debian/po/templates.pot --- strongswan-5.9.8/debian/po/templates.pot 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/templates.pot 2026-05-27 06:58:30.000000000 +0000 @@ -8,7 +8,7 @@ msgstr "" "Project-Id-Version: strongswan\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" diff -Nru strongswan-5.9.8/debian/po/tr.po strongswan-5.9.8/debian/po/tr.po --- strongswan-5.9.8/debian/po/tr.po 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/tr.po 2026-05-27 06:58:30.000000000 +0000 @@ -7,7 +7,7 @@ msgstr "" "Project-Id-Version: strongswan\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: 2013-10-24 11:17+0200\n" "Last-Translator: Atila KOÇ \n" "Language-Team: Türkçe \n" diff -Nru strongswan-5.9.8/debian/po/vi.po strongswan-5.9.8/debian/po/vi.po --- strongswan-5.9.8/debian/po/vi.po 2026-04-13 09:19:15.000000000 +0000 +++ strongswan-5.9.8/debian/po/vi.po 2026-05-27 06:58:30.000000000 +0000 @@ -6,7 +6,7 @@ msgstr "" "Project-Id-Version: strongswan 4.4.0-1\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-13 11:19+0200\n" +"POT-Creation-Date: 2026-05-27 09:05+0200\n" "PO-Revision-Date: 2010-10-03 19:22+1030\n" "Last-Translator: Clytie Siddall \n" "Language-Team: Vietnamese \n"