strongswan/strongswan-5.2.2.tar.bz2.sig

- Updated to strongSwan 5.2.2 providing the following changes: Changes in version 5.2.2: * Fixed a denial-of-service vulnerability triggered by an IKEv2 Key Exchange payload that contains the Diffie-Hellman group 1025. This identifier was used internally for DH groups with custom generator and prime. Because these arguments are missing when creating DH objects based on the KE payload an invalid pointer dereference occurred. This allowed an attacker to crash the IKE daemon with a single IKE_SA_INIT message containing such a KE payload. The vulnerability has been registered as CVE-2014-9221. * The left/rightid options in ipsec.conf, or any other identity in strongSwan, now accept prefixes to enforce an explicit type, such as email: or fqdn:. Note that no conversion is done for the remaining string, refer to ipsec.conf(5) for details. * The post-quantum Bimodal Lattice Signature Scheme (BLISS) can be used as an IKEv2 public key authentication method. The pki tool offers full support for the generation of BLISS key pairs and certificates. * Fixed mapping of integrity algorithms negotiated for AH via IKEv1. This could cause interoperability issues when connecting to older versions of charon. Changes in version 5.2.1: * The new charon-systemd IKE daemon implements an IKE daemon tailored for use with systemd. It avoids the dependency on ipsec starter and uses swanctl as configuration backend, building a simple and lightweight solution. It supports native systemd journal logging. * Support for IKEv2 fragmentation as per RFC 7383 has been added. Like IKEv1 fragmentation it can be enabled by setting fragmentation=yes in ipsec.conf. * Support of the TCG TNC IF-M Attribute Segmentation specification proposal. All attributes can be segmented. Additionally TCG/SWID Tag, TCG/SWID Tag ID and IETF/Installed Packages attributes can be processed incrementally on a per segment basis. OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=85 2015-01-05 15:41:37 +01:00			`-----BEGIN PGP SIGNATURE-----`
			`Version: GnuPG v1`

			`iQGcBAABAgAGBQJUn/PYAAoJEN9CwXCzTbp3+PML/2IJQEI240BwPOpXEGrJ0jnR`
			`Mmq7qXD3QLnUtpyX2/dXVV6X6PzdXiCubOj9m59VNSD6Qsr5W3d44rg90Vf9VxX6`
			`5nwAWP9fWl1L8xKtC93dyPAe8eet9tMqIf6QY5LYCmKRXi9aotoARiyEjKRUsWdy`
			`O+nDS43PrwjcgHcV+dVbpA1FyFSwoX2zoDu0d1MMzOb+b8np9+2SdtsNVKaIqW5c`
			`39PphkQgpqBqM1nkO0LUydsdCpE+/Xq4yNP77eSio7b6b2eyAjD9gBlNsE4FHoU0`
			`gyDKgdcOIPYmS8VD2J4efxQDjGpj6VV4wvXAo9tE7x/joIFT+Eg9LsD42l7yReaY`
			`G/G87HVgA0DH67lBjoMfkhZcHCSTofM4cm7eOC7s48PF4HvnAM1L5bH7UzoehV9c`
			`YvIUO/Q+7on6nvnW4AYUVXc/fAq7IUB6hYYCX6CHsb1U7gkEa7NseLwcoLmbMIfB`
			`QaziGo6KHG4XFTdlu1LrQBip8NdJZh7v7fYJd/sFjA==`
			`=bacU`
			`-----END PGP SIGNATURE-----`