Commit 054c49df11 for strongswan.org

commit 054c49df11630c22062ce1d67be22cb901f55b1e
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Fri Aug 28 17:01:21 2026 +0200

    NEWS: Add info about CVEs (CVE-2026-78123..78135)

diff --git a/NEWS b/NEWS
index 1b0cd740e3..02f1d57aa4 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,43 @@
 strongswan-6.1.0
 ----------------

+- CVE-2026-78123 - Fixed a vulnerability in the openssl plugin related to the
+  processing of PKCS#7 containers that can result in a crash.
+
+- CVE-2026-78124 - Fixed a vulnerability in the openssl plugin related to the
+  enumeration of certificates in PKCS#7 containers that can result in leaks.
+
+- CVE-2026-78126 - Fixed a vulnerability in the eap-aka plugin related to
+  processing an unexpected AKA-Synchronization-Failure that results in a crash.
+
+- CVE-2026-78127 - Fixed a vulnerability in libcharon related to the logging of
+  IKE messages that can result in a denial of service via memory exhaustion.
+
+- CVE-2026-78129 - Fixed a vulnerability in libstrongswan related to the
+  processing of encrypted PKCS#7 containers that can result in a DoS.
+
+- CVE-2026-78130 - Fixed a vulnerability in the x509 plugin related to the
+  verification of X.509 attribute certificates that can lead to a DoS.
+
+- CVE-2026-78131 - Fixed a vulnerability in the x509 plugin related to the
+  parsing of identities in X.509 attribute certificates that can lead to leaks.
+
+- CVE-2026-78132 - Fixed a vulnerability in the x509 plugin related to the
+  parsing of the ietfAttrSyntax ASN.1 type in X.509 attribute certificates that
+  can lead to a denial of service.
+
+- CVE-2026-78133 - Fixed a vulnerability in libcharon related to the handling of
+  IKEv2 rekeying collisions that can result in a use-after-free and potentially
+  remote code execution.
+
+- CVE-2026-78134 - Fixed a vulnerability in the eap-peap and eap-ttls plugins
+  related to the propagation of authentication details from inner EAP methods
+  that can result in incorrect ID binding and potential authorization bypass.
+
+- CVE-2026-78135 - Fixed a vulnerability in libcharon related to the handling of
+  CREATE_CHILD_SA requests on unestablished IKE SAs that can result in the
+  creation of a usable Child SA before authentication completes.
+
 - IKEv1 is now disabled by default. Support will be removed in a future release.

 - Added support for XFRM_MSG_MIGRATE_STATE on Linux 7.2+.