NEWS: Add info about CVE-2023-26463

strongswan · Mar 2, 2023 · ed839b3 · ed839b3
1 parent 8aa13a1
commit ed839b3
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/NEWS b/NEWS
@@ -1,6 +1,12 @@
 strongswan-5.9.10
 -----------------
 
+- Fixed a vulnerability related to certificate verification in TLS-based EAP
+  methods that leads to an authentication bypass followed by an expired pointer
+  dereference that results in a denial of service and possibly even remote code
+  execution.
+  This vulnerability has been registered as CVE-2023-26463.
+
 - Added support for full packet hardware offload for IPsec SAs and policies with
   Linux 6.2 kernels to the kernel-netlink plugin.