git: eea55ca7b5c6 - main - security/vuxml: Record strongswan buffer overflow

From: Fernando Apesteguía <fernape_at_FreeBSD.org>
Date: Sun, 10 Dec 2023 16:58:00 UTC
The branch main has been updated by fernape:

URL: https://cgit.FreeBSD.org/ports/commit/?id=eea55ca7b5c621fd4f032b1f256b8472fbae2b15

commit eea55ca7b5c621fd4f032b1f256b8472fbae2b15
Author:     Fernando Apesteguía <fernape@FreeBSD.org>
AuthorDate: 2023-12-09 12:31:35 +0000
Commit:     Fernando Apesteguía <fernape@FreeBSD.org>
CommitDate: 2023-12-10 16:57:47 +0000

    security/vuxml: Record strongswan buffer overflow
    
    strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated
    remote code execution via a DH public value that exceeds the internal buffer in
    charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can
    occur via a crafted IKE_SA_INIT message.
    
    NVD score not yet provided.
    
    PR:     275620
---
 security/vuxml/vuln/2023.xml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml
index dcc73a792dd8..790a48f245fd 100644
--- a/security/vuxml/vuln/2023.xml
+++ b/security/vuxml/vuln/2023.xml
@@ -1,3 +1,33 @@
+  <vuln vid="bbda3d16-968e-11ee-b780-b42e991fc52e">
+    <topic>strongswan -- buffer overflow</topic>
+    <affects>
+      <package>
+	<name>null</name>
+	<range><lt>5.9.12</lt></range>
+      </package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>cve@mitre.org reports:</p>
+	<blockquote cite="https://github.com/strongswan/strongswan/releases">
+	  <p>strongSwan before 5.9.12 has a buffer overflow and possible
+	unauthenticated remote code execution via a DH public value that
+	exceeds the internal buffer in charon-tkm&apos;s DH proxy.  The
+	earliest affected version is 5.3.0.  An attack can occur via a
+	crafted IKE_SA_INIT message.</p>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2023-41913</cvename>
+      <url>https://nvd.nist.gov/vuln/detail/CVE-2023-41913</url>
+    </references>
+    <dates>
+      <discovery>2023-12-07</discovery>
+      <entry>2023-12-09</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="e07a7754-12a4-4661-b852-fd221d68955f">
     <topic>electron25 -- multiple vulnerabilities</topic>
     <affects>