Version in base suite: 6.0.1-6+deb13u5 Base version: strongswan_6.0.1-6+deb13u5 Target version: strongswan_6.0.1-6+deb13u6 Base file: /srv/ftp-master.debian.org/ftp/pool/main/s/strongswan/strongswan_6.0.1-6+deb13u5.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/s/strongswan/strongswan_6.0.1-6+deb13u6.dsc changelog | 6 patches/0017-identification-Fix-double-free-when-cloning-empty-ID.patch | 86 ++++++++++ patches/series | 1 po/ca.po | 2 po/cs.po | 2 po/da.po | 2 po/de.po | 2 po/es.po | 2 po/eu.po | 2 po/fi.po | 2 po/fr.po | 2 po/gl.po | 2 po/it.po | 2 po/ja.po | 2 po/nb.po | 2 po/nl.po | 2 po/pl.po | 2 po/pt.po | 2 po/pt_BR.po | 2 po/ru.po | 2 po/sv.po | 2 po/templates.pot | 2 po/tr.po | 2 po/vi.po | 2 24 files changed, 114 insertions(+), 21 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpp32t5ewk/strongswan_6.0.1-6+deb13u5.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpp32t5ewk/strongswan_6.0.1-6+deb13u6.dsc: no acceptable signature found diff -Nru strongswan-6.0.1/debian/changelog strongswan-6.0.1/debian/changelog --- strongswan-6.0.1/debian/changelog 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/changelog 2026-05-27 06:40:18.000000000 +0000 @@ -1,3 +1,9 @@ +strongswan (6.0.1-6+deb13u6) trixie-security; urgency=medium + + * d/patches: add fix for double-free when cloning empty IDs (CVE-2026-47895) + + -- Yves-Alexis Perez Wed, 27 May 2026 08:40:18 +0200 + strongswan (6.0.1-6+deb13u5) trixie-security; urgency=medium * d/patches: add fix for integer underflow in libsimaka when handling diff -Nru strongswan-6.0.1/debian/patches/0017-identification-Fix-double-free-when-cloning-empty-ID.patch strongswan-6.0.1/debian/patches/0017-identification-Fix-double-free-when-cloning-empty-ID.patch --- strongswan-6.0.1/debian/patches/0017-identification-Fix-double-free-when-cloning-empty-ID.patch 1970-01-01 00:00:00.000000000 +0000 +++ strongswan-6.0.1/debian/patches/0017-identification-Fix-double-free-when-cloning-empty-ID.patch 2026-05-27 06:40:18.000000000 +0000 @@ -0,0 +1,86 @@ +From: "R. Elliott Childre" +Date: Mon, 18 May 2026 00:53:24 -0400 +Subject: identification: Fix double-free when cloning empty IDs + +The clone() method was missing a branch when there is an encoded chunk +of length 0 that still needed to be cloned. Otherwise, the destruction +of the clone frees the same pointer that the original owns. + +This double free was found with an improved `fuzz_ids` fuzz harness and +a two byte input to create an identification from "@#" or [0x40, 0x23]. +It can also be triggered with `:#` e.g. `dns:#`. + +One of the problematic constructors is used to parse EAP-Identities, +which are cloned before storing them in the auth-cfg. So this can be +triggered by an unauthenticated attacker. + +Note that while the length check was already added with 418dbd624363 +("cloning %any ID without zero-byte memleak") and identities that trigger +this can be created since 86ab5636c2c9 ("support for @#hex ID_KEY_ID +identification_t"), it was the referenced commit that made the length +check problematic. + +Fixes: 2147da40a5d7 ("simplified identification_t.clone() using memcpy") +Fixes: CVE-2026-47895 +--- + .../tests/suites/test_identification.c | 23 ++++++++++++++++++++++ + src/libstrongswan/utils/identification.c | 5 +---- + 2 files changed, 24 insertions(+), 4 deletions(-) + +diff --git a/src/libstrongswan/tests/suites/test_identification.c b/src/libstrongswan/tests/suites/test_identification.c +index db40437..565971a 100644 +--- a/src/libstrongswan/tests/suites/test_identification.c ++++ b/src/libstrongswan/tests/suites/test_identification.c +@@ -1408,6 +1408,28 @@ START_TEST(test_clone) + } + END_TEST + ++START_TEST(test_clone_empty) ++{ ++ identification_t *a, *b; ++ chunk_t a_enc, b_enc; ++ ++ /* this produces an empty but non-NULL encoding, which previously caused a ++ * double-free when destroying a clone */ ++ a = identification_create_from_string("@#"); ++ ck_assert(a != NULL); ++ a_enc = a->get_encoding(a); ++ ++ b = a->clone(a); ++ ck_assert(b != NULL); ++ ck_assert(a != b); ++ b_enc = b->get_encoding(b); ++ ck_assert(a_enc.ptr != b_enc.ptr); ++ ++ b->destroy(b); ++ a->destroy(a); ++} ++END_TEST ++ + Suite *identification_suite_create() + { + Suite *s; +@@ -1465,6 +1487,7 @@ Suite *identification_suite_create() + + tc = tcase_create("clone"); + tcase_add_test(tc, test_clone); ++ tcase_add_test(tc, test_clone_empty); + suite_add_tcase(s, tc); + + return s; +diff --git a/src/libstrongswan/utils/identification.c b/src/libstrongswan/utils/identification.c +index d31955b..b8e68f8 100644 +--- a/src/libstrongswan/utils/identification.c ++++ b/src/libstrongswan/utils/identification.c +@@ -1586,10 +1586,7 @@ METHOD(identification_t, clone_, identification_t*, + private_identification_t *clone = malloc_thing(private_identification_t); + + memcpy(clone, this, sizeof(private_identification_t)); +- if (this->encoded.len) +- { +- clone->encoded = chunk_clone(this->encoded); +- } ++ clone->encoded = chunk_clone(this->encoded); + return &clone->public; + } + diff -Nru strongswan-6.0.1/debian/patches/series strongswan-6.0.1/debian/patches/series --- strongswan-6.0.1/debian/patches/series 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/patches/series 2026-05-27 06:40:18.000000000 +0000 @@ -14,3 +14,4 @@ 0014-pkcs5-pkcs7-Avoid-NULL-pointer-dereference-when-veri.patch 0015-constraints-Case-insensitive-matching-and-reject-exc.patch 0016-gmp-Avoid-crash-and-timing-leaks-in-PKCS-1-v1.5-decr.patch +0017-identification-Fix-double-free-when-cloning-empty-ID.patch diff -Nru strongswan-6.0.1/debian/po/ca.po strongswan-6.0.1/debian/po/ca.po --- strongswan-6.0.1/debian/po/ca.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/ca.po 2026-05-27 06:40:18.000000000 +0000 @@ -8,7 +8,7 @@ msgstr "" "Project-Id-Version: strongswan\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2025-01-30 07:33+0100\n" "Last-Translator: poc senderi \n" "Language-Team: Catalan \n" diff -Nru strongswan-6.0.1/debian/po/cs.po strongswan-6.0.1/debian/po/cs.po --- strongswan-6.0.1/debian/po/cs.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/cs.po 2026-05-27 06:40:18.000000000 +0000 @@ -13,7 +13,7 @@ msgstr "" "Project-Id-Version: strongswan\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2013-10-28 14:42+0100\n" "Last-Translator: Miroslav Kure \n" "Language-Team: Czech \n" diff -Nru strongswan-6.0.1/debian/po/da.po strongswan-6.0.1/debian/po/da.po --- strongswan-6.0.1/debian/po/da.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/da.po 2026-05-27 06:40:18.000000000 +0000 @@ -7,7 +7,7 @@ msgstr "" "Project-Id-Version: strongswan\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2013-10-06 12:42+0000\n" "Last-Translator: Joe Hansen \n" "Language-Team: Danish \n" diff -Nru strongswan-6.0.1/debian/po/de.po strongswan-6.0.1/debian/po/de.po --- strongswan-6.0.1/debian/po/de.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/de.po 2026-05-27 06:40:18.000000000 +0000 @@ -8,7 +8,7 @@ msgstr "" "Project-Id-Version: strongswan 4.4.0-1\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2013-11-02 15:40+0100\n" "Last-Translator: Helge Kreutzmann \n" "Language-Team: German \n" diff -Nru strongswan-6.0.1/debian/po/es.po strongswan-6.0.1/debian/po/es.po --- strongswan-6.0.1/debian/po/es.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/es.po 2026-05-27 06:40:18.000000000 +0000 @@ -31,7 +31,7 @@ msgstr "" "Project-Id-Version: strongswan 4.4.1-5\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2013-12-17 17:19-0300\n" "Last-Translator: Matías Bellone \n" "Language-Team: Debian l10n Spanish \n" diff -Nru strongswan-6.0.1/debian/po/eu.po strongswan-6.0.1/debian/po/eu.po --- strongswan-6.0.1/debian/po/eu.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/eu.po 2026-05-27 06:40:18.000000000 +0000 @@ -8,7 +8,7 @@ msgstr "" "Project-Id-Version: strongswan_4.4.1-5.1_eu\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2013-10-15 21:41+0200\n" "Last-Translator: Iñaki Larrañaga Murgoitio \n" "Language-Team: Basque \n" diff -Nru strongswan-6.0.1/debian/po/fi.po strongswan-6.0.1/debian/po/fi.po --- strongswan-6.0.1/debian/po/fi.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/fi.po 2026-05-27 06:40:18.000000000 +0000 @@ -6,7 +6,7 @@ msgstr "" "Project-Id-Version: strongswan\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2009-05-25 14:49+0100\n" "Last-Translator: Esko Arajärvi \n" "Language-Team: Finnish \n" diff -Nru strongswan-6.0.1/debian/po/fr.po strongswan-6.0.1/debian/po/fr.po --- strongswan-6.0.1/debian/po/fr.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/fr.po 2026-05-27 06:40:18.000000000 +0000 @@ -7,7 +7,7 @@ msgstr "" "Project-Id-Version: strongswan\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2010-06-24 22:17+0200\n" "Last-Translator: Christian Perrier \n" "Language-Team: French \n" diff -Nru strongswan-6.0.1/debian/po/gl.po strongswan-6.0.1/debian/po/gl.po --- strongswan-6.0.1/debian/po/gl.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/gl.po 2026-05-27 06:40:18.000000000 +0000 @@ -6,7 +6,7 @@ msgstr "" "Project-Id-Version: templates_[kI6655]\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2009-05-25 14:50+0100\n" "Last-Translator: marce villarino \n" "Language-Team: Galician \n" diff -Nru strongswan-6.0.1/debian/po/it.po strongswan-6.0.1/debian/po/it.po --- strongswan-6.0.1/debian/po/it.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/it.po 2026-05-27 06:40:18.000000000 +0000 @@ -7,7 +7,7 @@ msgstr "" "Project-Id-Version: strongswan\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2013-11-09 13:41+0200\n" "Last-Translator: Beatrice Torracca \n" "Language-Team: Italian \n" diff -Nru strongswan-6.0.1/debian/po/ja.po strongswan-6.0.1/debian/po/ja.po --- strongswan-6.0.1/debian/po/ja.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/ja.po 2026-05-27 06:40:18.000000000 +0000 @@ -16,7 +16,7 @@ msgstr "" "Project-Id-Version: strongswan 4.4.1-4\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2013-02-07 21:28+0900\n" "Last-Translator: Hideki Yamane \n" "Language-Team: Japanese \n" diff -Nru strongswan-6.0.1/debian/po/nb.po strongswan-6.0.1/debian/po/nb.po --- strongswan-6.0.1/debian/po/nb.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/nb.po 2026-05-27 06:40:18.000000000 +0000 @@ -6,7 +6,7 @@ msgstr "" "Project-Id-Version: nb\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2013-10-06 17:37+0200\n" "Last-Translator: Bjørn Steensrud \n" "Language-Team: Norwegian Bokmål \n" diff -Nru strongswan-6.0.1/debian/po/nl.po strongswan-6.0.1/debian/po/nl.po --- strongswan-6.0.1/debian/po/nl.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/nl.po 2026-05-27 06:40:18.000000000 +0000 @@ -10,7 +10,7 @@ msgstr "" "Project-Id-Version: strongswan 4.5.0-1\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2014-09-24 18:39+0200\n" "Last-Translator: Frans Spiesschaert \n" "Language-Team: Debian Dutch l10n Team \n" diff -Nru strongswan-6.0.1/debian/po/pl.po strongswan-6.0.1/debian/po/pl.po --- strongswan-6.0.1/debian/po/pl.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/pl.po 2026-05-27 06:40:18.000000000 +0000 @@ -6,7 +6,7 @@ msgstr "" "Project-Id-Version: \n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2012-01-31 15:36+0100\n" "Last-Translator: Michał Kułach \n" "Language-Team: Polish \n" diff -Nru strongswan-6.0.1/debian/po/pt.po strongswan-6.0.1/debian/po/pt.po --- strongswan-6.0.1/debian/po/pt.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/pt.po 2026-05-27 06:40:18.000000000 +0000 @@ -8,7 +8,7 @@ msgstr "" "Project-Id-Version: strongswan 5.1.0-3\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2013-11-18 00:33+0000\n" "Last-Translator: Américo Monteiro \n" "Language-Team: Portuguese \n" diff -Nru strongswan-6.0.1/debian/po/pt_BR.po strongswan-6.0.1/debian/po/pt_BR.po --- strongswan-6.0.1/debian/po/pt_BR.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/pt_BR.po 2026-05-27 06:40:18.000000000 +0000 @@ -9,7 +9,7 @@ msgstr "" "Project-Id-Version: strongswan 5.1.3-4\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2014-06-25 18:13-0300\n" "Last-Translator: Adriano Rafael Gomes \n" "Language-Team: Brazilian Portuguese \n" "Language-Team: Russian \n" diff -Nru strongswan-6.0.1/debian/po/sv.po strongswan-6.0.1/debian/po/sv.po --- strongswan-6.0.1/debian/po/sv.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/sv.po 2026-05-27 06:40:18.000000000 +0000 @@ -8,7 +8,7 @@ msgstr "" "Project-Id-Version: strongswan_sv\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2013-10-07 09:05+0100\n" "Last-Translator: Martin Bagge / brother \n" "Language-Team: Swedish \n" diff -Nru strongswan-6.0.1/debian/po/templates.pot strongswan-6.0.1/debian/po/templates.pot --- strongswan-6.0.1/debian/po/templates.pot 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/templates.pot 2026-05-27 06:40:18.000000000 +0000 @@ -8,7 +8,7 @@ msgstr "" "Project-Id-Version: strongswan\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" diff -Nru strongswan-6.0.1/debian/po/tr.po strongswan-6.0.1/debian/po/tr.po --- strongswan-6.0.1/debian/po/tr.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/tr.po 2026-05-27 06:40:18.000000000 +0000 @@ -7,7 +7,7 @@ msgstr "" "Project-Id-Version: strongswan\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2013-10-24 11:17+0200\n" "Last-Translator: Atila KOÇ \n" "Language-Team: Türkçe \n" diff -Nru strongswan-6.0.1/debian/po/vi.po strongswan-6.0.1/debian/po/vi.po --- strongswan-6.0.1/debian/po/vi.po 2026-04-09 07:36:31.000000000 +0000 +++ strongswan-6.0.1/debian/po/vi.po 2026-05-27 06:40:18.000000000 +0000 @@ -6,7 +6,7 @@ msgstr "" "Project-Id-Version: strongswan 4.4.0-1\n" "Report-Msgid-Bugs-To: strongswan@packages.debian.org\n" -"POT-Creation-Date: 2026-04-09 09:37+0200\n" +"POT-Creation-Date: 2026-05-27 08:41+0200\n" "PO-Revision-Date: 2010-10-03 19:22+1030\n" "Last-Translator: Clytie Siddall \n" "Language-Team: Vietnamese \n"