Bug 35265 - strongswan new security issue CVE-2026-25075
Summary: strongswan new security issue CVE-2026-25075
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2026-03-24 15:03 CET by Nicolas Salguero
Modified: 2026-03-29 01:55 CET (History)
2 users (show)

See Also:
Source RPM: strongswan-5.9.14-1.1.mga9.src.rpm
CVE: CVE-2026-25075
Status comment:
andrewsfarm: test_passed_mga9_64+


Attachments

Description Nicolas Salguero 2026-03-24 15:03:16 CET
Debian has issued an advisory on March 23:
https://lists.debian.org/debian-security-announce/2026/msg00085.html
Nicolas Salguero 2026-03-24 15:04:08 CET

Flags: (none) => affects_mga9+
Whiteboard: (none) => MGA9TOO
CVE: (none) => CVE-2026-25075
Source RPM: (none) => strongswan-6.0.4-1.mga10.src.rpm, strongswan-5.9.14-1.1.mga9.src.rpm

Comment 1 Nicolas Salguero 2026-03-24 15:19:53 CET
Ubuntu has issued an advisory on March 23:
https://ubuntu.com/security/notices/USN-8117-1
Comment 2 Nicolas Salguero 2026-03-24 15:38:23 CET
Suggested advisory:
========================

The updated packages fix a security vulnerability:

strongSwan 4.5.0 < 6.0.5 EAP-TTLS AVP Parsing Integer Underflow. (CVE-2026-25075)

References:
https://lists.debian.org/debian-security-announce/2026/msg00085.html
https://ubuntu.com/security/notices/USN-8117-1
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/WWO45DS2P5I7KBXXZSDAS4ECX6DR3NYJ/
========================

Updated packages in core/updates_testing:
========================
lib(64àstrongswan0-5.9.14-1.2.mga9
strongswan-5.9.14-1.2.mga9
strongswan-charon-nm-5.9.14-1.2.mga9
strongswan-tnc-imcvs-5.9.14-1.2.mga9

from SRPM:
strongswan-5.9.14-1.2.mga9.src.rpm

Flags: affects_mga9+ => (none)
Whiteboard: MGA9TOO => (none)
Version: Cauldron => 9
Assignee: bugsquad => qa-bugs
Source RPM: strongswan-6.0.4-1.mga10.src.rpm, strongswan-5.9.14-1.1.mga9.src.rpm => strongswan-5.9.14-1.1.mga9.src.rpm
Status: NEW => ASSIGNED

Comment 3 Thomas Andrews 2026-03-25 17:21:16 CET
MGA9-64 Plasma, using Network Manager.

No installation issues. I repeated the test, such as it is, from bug34705 comment 4, with the same results. As before, that's as far as I can go with it.

Giving it an OK, and validating.

Keywords: (none) => validated_update
Flags: (none) => test_passed_mga9_64+
CC: (none) => andrewsfarm, sysadmin-bugs
Whiteboard: (none) => MGA9-64-OK

katnatek 2026-03-28 19:29:09 CET

Keywords: (none) => advisory

Comment 4 Mageia Robot 2026-03-29 01:55:54 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2026-0072.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.