Bug 931845 – VUL-1: strongswan: The Logjam Attack / weakdh.org

Bug 931845 - VUL-1: strongswan: The Logjam Attack / weakdh.org


Summary:	VUL-1: strongswan: The Logjam Attack / weakdh.org

Status:	IN_PROGRESS

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Major
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/116977/
Whiteboard:	maint:released:sle10-sp3:63822 maint:...
Keywords:

Depends on:	CVE-2015-4000
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2015-05-21 11:46 UTC by Marcus Meissner
Modified:	2021-06-18 07:13 UTC (History)
CC List:	9 users (show)

See Also:
Found By:	---
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Marcus Meissner 2015-05-21 11:46:11 UTC

+++ This bug was initially created as a clone of Bug #931600 +++

This bug refers to the strongswan Logjam impact.

Main issue is probably that there is a standard 1024bit MODP 1024 group
aka PTS_DH_GROUP_IKE2, and it is unclear if we can disable it.

(needs more research)

Comment 1 Marcus Meissner 2015-05-21 12:09:48 UTC

(in SLE12 fips mode, 1024bit dh is not selected for instance)

Comment 2 Swamp Workflow Management 2015-05-21 22:00:52 UTC

bugbot adjusting priority

Comment 7 Marcus Meissner 2015-06-22 06:24:29 UTC

So disabling the 768 group is a thing we can do with the next round of updates.

Comment 8 Marcus Meissner 2015-07-07 15:37:35 UTC

For inclusion in next strongswan maintenance update.

opensuse updates can be already submitted of course

Comment 10 Swamp Workflow Management 2017-08-07 16:28:05 UTC

An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2017-08-21.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/63821