CVE-2015-8023
The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4...
The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.
Exploit likelihood
What each source reports
NVD Score used
The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.
- Record
CVE-2015-8023- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-20, CWE-264
- Updated
- 2026-11-02
CVE List No score
The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.
- Record
CVE-2015-8023- Updated
- 2026-11-02
EUVDEUVD-2015-7918 No score
The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.
- Record
EUVD-2015-7918- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4qm7-rm85-wr68 No score
The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4...
The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.
- Record
GHSA-4qm7-rm85-wr68- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.
- Record
CVE-2015-8023- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-8023 No score
The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.
- Record
DEBIAN-CVE-2015-8023- Updated
- 2026-11-02
Show 6 moreShow less
OSVopenSUSE-SU-2024:10579-1 No score
strongswan-5.3.5-1.1 on GA media
These are all security issues fixed in the strongswan-5.3.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10579-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:2183-1 No score
Security update for strongswan
The strongswan package was updated to fix the following security issue:
- CVE-2015-8023: Fixed an authentication bypass vulnerability in the eap-mschapv2 plugin (bsc#953817).
- Record
SUSE-SU-2015:2183-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:2183-2 No score
Security update for strongswan
The strongswan package was updated to fix the following security issue:
- CVE-2015-8023: Fixed an authentication bypass vulnerability in the eap-mschapv2 plugin (bsc#953817).
- Record
SUSE-SU-2015:2183-2- Updated
- 2026-11-02
OSVSUSE-SU-2015:2186-1 No score
Security update for strongswan
The strongswan package was updated to fix the following security issue:
- CVE-2015-8023: Fixed an authentication bypass vulnerability in the eap-mschapv2 plugin (bsc#953817).
- Record
SUSE-SU-2015:2186-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-8023 No score
The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.
- Record
UBUNTU-CVE-2015-8023- Updated
- 2026-11-02
OSVUSN-2811-1 No score
strongswan vulnerability
It was discovered that the strongSwan eap-mschapv2 plugin incorrectly handled state. A remote attacker could use this issue to bypass authentication.
- Record
USN-2811-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
strongswanDebian:12 |
before 5.3.3-3 | 5.3.3-3 |
strongswanDebian:13 |
before 5.3.3-3 | 5.3.3-3 |
strongswanDebian:14 |
before 5.3.3-3 | 5.3.3-3 |
strongswanDebian:6.0 |
before 4.4.1-5.8, plus listed versions 4.4.1-5.14.4.1-5.24.4.1-5.34.4.1-5.44.4.1-5.54.4.1-5.64.4.1-5.7 |
4.4.1-5.8 |
strongswanDebian:7 |
before 4.5.2-1.5+deb7u8, plus listed versions 4.5.2-1.5+deb7u14.5.2-1.5+deb7u24.5.2-1.5+deb7u2~bpo60+14.5.2-1.5+deb7u34.5.2-1.5+deb7u3~bpo60+14.5.2-1.5+deb7u44.5.2-1.5+deb7u64.5.2-1.5+deb7u7 |
4.5.2-1.5+deb7u8 |
strongswanDebian:8 |
before 5.2.1-6+deb8u2, plus listed versions 5.2.1-65.2.1-6+deb8u15.2.1-6+deb8u1~bpo70+15.2.1-6+deb8u2~bpo70+1 |
5.2.1-6+deb8u2 |
strongswanSUSE:Linux Enterprise Desktop 12 |
before 5.1.3-22.1 | 5.1.3-22.1 |
strongswanSUSE:Linux Enterprise Server 12 |
before 5.1.3-22.1 | 5.1.3-22.1 |
strongswanSUSE:Linux Enterprise Server for SAP Applications 12 |
before 5.1.3-22.1 | 5.1.3-22.1 |
strongswanSUSE:Linux Enterprise Desktop 12 SP1 |
before 5.1.3-22.1 | 5.1.3-22.1 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
strongswanSUSE:Linux Enterprise Server 12 SP1 |
before 5.1.3-22.1 | 5.1.3-22.1 |
strongswanSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 5.1.3-22.1 | 5.1.3-22.1 |
strongswanSUSE:Linux Enterprise Desktop 11 SP3 |
before 4.4.0-6.32.1 | 4.4.0-6.32.1 |
strongswanSUSE:Linux Enterprise Desktop 11 SP4 |
before 4.4.0-6.32.1 | 4.4.0-6.32.1 |
strongswanSUSE:Linux Enterprise Server 11 SP3 |
before 4.4.0-6.32.1 | 4.4.0-6.32.1 |
strongswanSUSE:Linux Enterprise Server 11 SP3-TERADATA |
before 4.4.0-6.32.1 | 4.4.0-6.32.1 |
strongswanSUSE:Linux Enterprise Server for SAP Applications 11 SP3 |
before 4.4.0-6.32.1 | 4.4.0-6.32.1 |
strongswanSUSE:Linux Enterprise Server 11 SP4 |
before 4.4.0-6.32.1 | 4.4.0-6.32.1 |
strongswanSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 4.4.0-6.32.1 | 4.4.0-6.32.1 |
strongswanUbuntu:14.04:LTS |
before 5.1.2-0ubuntu2.4, plus listed versions 4.6.4-95.1.0-25.1.0-35.1.1-0ubuntu15.1.1-0ubuntu2 Show 15 moreShow less5.1.1-0ubuntu35.1.1-0ubuntu45.1.1-0ubuntu55.1.1-0ubuntu75.1.1-0ubuntu145.1.1-0ubuntu175.1.2~dr3+git20130120-0ubuntu25.1.2~dr3+git20130120-0ubuntu35.1.2~rc1-0ubuntu35.1.2~rc1-0ubuntu45.1.2~rc2-0ubuntu25.1.2-0ubuntu15.1.2-0ubuntu25.1.2-0ubuntu2.25.1.2-0ubuntu2.3 |
5.1.2-0ubuntu2.4 |
strongswanUbuntu:16.04:LTS |
before 5.1.2-0ubuntu7, plus listed versions 5.1.2-0ubuntu6 |
5.1.2-0ubuntu7 |
strongswanopenSUSE:Tumbleweed From an advisory covering 11 CVEs |
before 5.3.5-1.1 | 5.3.5-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-8023 is a medium vulnerability (CVSS 5.0) in Strongswan, published November 16, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.58%, the 85th percentile. Fixed in strongswan 5.3.3-3.
References
lists.opensuse.org/opensuse-security-announce/2015-12/msg00025.html
strongswan.org/blog/2015/11/16/strongswan-vulnerability-%28cve-2015-8023%29.html
securityfocus.com/bid/84947
debian.org/security/2015/dsa-3398
ubuntu.com/usn/USN-2811-1
Show 23 moreShow less
nvd.nist.gov/vuln/detail/CVE-2015-8023
github.com/advisories/GHSA-4qm7-rm85-wr68
security-tracker.debian.org/tracker/CVE-2015-8023
suse.com/support/update/announcement/2015/suse-su-20152183-1
bugzilla.suse.com/953817
ubuntu.com/security/CVE-2015-8023
cve.org/CVERecord?id=CVE-2015-8023