openSUSE has issued an advisory on October 29: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/QVE27CU4U3DGHAD4EVF75YM3RK423ZQS/ See also: https://www.strongswan.org/blog/2025/10/27/strongswan-vulnerability-(cve-2025-62291).html Patch: https://download.strongswan.org/security/CVE-2025-62291/
Source RPM: (none) => strongswan-5.9.14-1.mga9.src.rpmCVE: (none) => CVE-2025-62291Version: Cauldron => 9Status comment: (none) => Patch available from upstream
Thanks for the patch ref. The middle URL above says Oct 27, 2025 "All versions since 4.2.12 are affected". BUT: "strongSwan 6.0.3 Released Oct 27, 2025 We are happy to announce the release of strongSwan 6.0.3, which fixes a vulnerability in the eap-mschapv2 plugin" Cauldron is at version: 6.0.3, just 3d ago, which fixes the problem. M9 remains. Assigning to DavidG who is the visible packager for this pkg.
Assignee: bugsquad => geiger.david68210
Suggested advisory: ======================== The updated packages fix a security vulnerability: Buffer Overflow When Handling EAP-MSCHAPv2 Failure Requests. (CVE-2025-62291) References: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/QVE27CU4U3DGHAD4EVF75YM3RK423ZQS/ https://www.strongswan.org/blog/2025/10/27/strongswan-vulnerability-(cve-2025-62291).html ======================== Updated packages in core/updates_testing: ======================== lib(64)strongswan0-5.9.14-1.1.mga9 strongswan-5.9.14-1.1.mga9 strongswan-charon-nm-5.9.14-1.1.mga9 strongswan-tnc-imcvs-5.9.14-1.1.mga9 from SRPM: strongswan-5.9.14-1.1.mga9.src.rpm
Status comment: Patch available from upstream => (none)Assignee: geiger.david68210 => qa-bugsStatus: NEW => ASSIGNED
MGA9-64 server Plasma Wayland on Compaq H000SB. No installation issues. I wanted to replicate the test from bug 33286 Comment 3, but I cann't figure out what TJ means by systemsettings/connections . I don't find this in systemsettings. Tried MCC - network - VPN, but that doesn't show strongswan as possible VPN-type
CC: (none) => herman.viaene
Keywords: (none) => advisory
MGA9-64 Plasma. There is a "Connections" tab in systemsettings under "Network" only if using Network Manager. I don't know how to do this if using our Network Center. In the "Connections" dialog, click on the green "+" to add a connection. Scroll down in the window that comes up to reveal different types of VPN connections. For this test, select "IPsec based VPN (strongswan)" and click on "create" to bring up the setup gui. I replicated that test, and it worked as before. Also as before, that's as far as I can take it because I know nothing of strongswan VPNs. Calling it OK, and validating.
Whiteboard: (none) => MGA9-64-OKKeywords: (none) => validated_updateCC: (none) => andrewsfarm, sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2025-0272.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED