SUSE-SU-2026:21547-1: important: Security update for strongswan

SLE-SECURITY-UPDATES null at suse.de
Mon May 11 08:34:52 UTC 2026 


# Security update for strongswan

Announcement ID: SUSE-SU-2026:21547-1  
Release Date: 2026-05-05T07:12:05Z  
Rating: important  
References:

  * bsc#1261705
  * bsc#1261706
  * bsc#1261708
  * bsc#1261712
  * bsc#1261717
  * bsc#1261718
  * bsc#1261720
  * jsc#PED-16145

  
Cross-References:

  * CVE-2026-35328
  * CVE-2026-35329
  * CVE-2026-35330
  * CVE-2026-35331
  * CVE-2026-35332
  * CVE-2026-35333
  * CVE-2026-35334

  
CVSS scores:

  * CVE-2026-35328 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-35328 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-35329 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-35329 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-35330 ( SUSE ):  9.2
    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-35330 ( SUSE ):  8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-35331 ( SUSE ):  6.3
    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-35331 ( SUSE ):  4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
  * CVE-2026-35332 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-35332 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-35333 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-35333 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-35334 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-35334 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

  
Affected Products:

  * SUSE Linux Enterprise Server 16.0
  * SUSE Linux Enterprise Server for SAP applications 16.0

  
  
An update that solves seven vulnerabilities and contains one feature can now be
installed.

## Description:

This update for strongswan fixes the following issues:

Update to version 6.0.6 (jsc#PED-16145).

Security issued fixed:

  * CVE-2026-35328: infinite loop when handling supported versions TLS extension
    (bsc#1261712).
  * CVE-2026-35329: NULL pointer dereference when processing padding in PKCS#7
    (bsc#1261717).
  * CVE-2026-35330: integer underflow when handling EAP-SIM/AKA attributes
    (bsc#1261705).
  * CVE-2026-35331: acceptance of certificates violating X.509 name constraints
    (bsc#1261718).
  * CVE-2026-35332: NULL pointer dereference when handling ECDH public value in
    TLS (bsc#1261708).
  * CVE-2026-35333: integer underflow when handling RADIUS attributes
    (bsc#1261706).
  * CVE-2026-35334: possible NULL pointer dereference in RSA decryption
    (bsc#1261720).

Other updates and bugfixes:

  * Version 6.0.6.
  * Enhancements and Optimizations
    * Added the unique ID to the log messages when creating an IKE SA as responder and when deleting such a half-open SA
    * The credential factory now enforces an upper limit of 10 when creating nested credentials.
    * Added Georgian translation to the NM plugin.
  * Fixes
    * IKEv2 fragments with a total fragment count lower than before are now dropped as mandated by the RFC .
    * Fixed a potential out-of-bounds read when parsing EAP-SIM/AKA attributes with actual length field.
    * Fixed a potential out-of-bounds read when enumerating hashes in OCSP CERTREQ payloads .
    * Fixed a potential crash in the vici plugin when parsing messages that encode the length of a VICI_LIST_ITEM incorrectly.
    * Avoid allocating a large buffer for TLS cipher suites on the stack using alloca().
    * Ensure TLS 1.3 CertificateRequest structures are valid on the client.
    * Prevent an infinite loop if the EAP-SIM version list on the client contains more than one entry .
    * Fixed a crash in the tnccs_11 plugin if TNCCS-ReasonStrings is empty or only contains empty nodes .
    * Fixed verification of RSA signatures with SHA3-224 via botan plugin.
    * Close the internal IPv6 socket when a tun_device_t is destroyed .
    * Update the address family in the SA selector when the addresses of a tunnel mode IPsec SA change in the kernel-netlink plugin.
  * Version 6.0.5:
  * Fixed a vulnerability in the eap-ttls plugin related to processing EAP-TTLS
    AVPs that can lead to resource exhaustion or a crash.
  * The new `icmp` option enables the forwarding of certain ICMP error messages
    (e.g. Fragmentation Needed), even if their source address doesn't match the
    negotiated traffic selectors, when running on Linux kernels that support
    this (v6.9+).
  * charon-cmd now supports childless IKE SA initiation with the `--childless`
    option.
  * The dhcp plugin now keeps track of address leases across make-before-break
    reauthentications to avoid releasing the address when the old SA is
    terminated
  * Added support for `organizationIdentifier` RDNs, which are used in e.g.
    eIDAS certificates, when parsing ASN.1 DN identities from strings.

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Enterprise Server for SAP applications 16.0  
    zypper in -t patch SUSE-SLES-16.0-680=1

  * SUSE Linux Enterprise Server 16.0  
    zypper in -t patch SUSE-SLES-16.0-680=1

## Package List:

  * SUSE Linux Enterprise Server for SAP applications 16.0 (ppc64le x86_64)
    * strongswan-nm-6.0.6-160000.1.1
    * strongswan-sqlite-debuginfo-6.0.6-160000.1.1
    * strongswan-debugsource-6.0.6-160000.1.1
    * strongswan-fips-6.0.6-160000.1.1
    * strongswan-nm-debuginfo-6.0.6-160000.1.1
    * strongswan-mysql-6.0.6-160000.1.1
    * strongswan-sqlite-6.0.6-160000.1.1
    * strongswan-debuginfo-6.0.6-160000.1.1
    * strongswan-ipsec-debuginfo-6.0.6-160000.1.1
    * strongswan-mysql-debuginfo-6.0.6-160000.1.1
    * strongswan-ipsec-6.0.6-160000.1.1
    * strongswan-6.0.6-160000.1.1
  * SUSE Linux Enterprise Server for SAP applications 16.0 (noarch)
    * strongswan-doc-6.0.6-160000.1.1
  * SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64)
    * strongswan-nm-6.0.6-160000.1.1
    * strongswan-sqlite-debuginfo-6.0.6-160000.1.1
    * strongswan-debugsource-6.0.6-160000.1.1
    * strongswan-fips-6.0.6-160000.1.1
    * strongswan-nm-debuginfo-6.0.6-160000.1.1
    * strongswan-mysql-6.0.6-160000.1.1
    * strongswan-sqlite-6.0.6-160000.1.1
    * strongswan-debuginfo-6.0.6-160000.1.1
    * strongswan-ipsec-debuginfo-6.0.6-160000.1.1
    * strongswan-mysql-debuginfo-6.0.6-160000.1.1
    * strongswan-ipsec-6.0.6-160000.1.1
    * strongswan-6.0.6-160000.1.1
  * SUSE Linux Enterprise Server 16.0 (noarch)
    * strongswan-doc-6.0.6-160000.1.1

## References:

  * https://www.suse.com/security/cve/CVE-2026-35328.html
  * https://www.suse.com/security/cve/CVE-2026-35329.html
  * https://www.suse.com/security/cve/CVE-2026-35330.html
  * https://www.suse.com/security/cve/CVE-2026-35331.html
  * https://www.suse.com/security/cve/CVE-2026-35332.html
  * https://www.suse.com/security/cve/CVE-2026-35333.html
  * https://www.suse.com/security/cve/CVE-2026-35334.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1261705
  * https://bugzilla.suse.com/show_bug.cgi?id=1261706
  * https://bugzilla.suse.com/show_bug.cgi?id=1261708
  * https://bugzilla.suse.com/show_bug.cgi?id=1261712
  * https://bugzilla.suse.com/show_bug.cgi?id=1261717
  * https://bugzilla.suse.com/show_bug.cgi?id=1261718
  * https://bugzilla.suse.com/show_bug.cgi?id=1261720
  * https://jira.suse.com/browse/PED-16145

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20260511/7efd55d6/attachment.htm>

More information about the sle-security-updates mailing list