{"id":"CVE-2015-8023","aliases":["DEBIAN-CVE-2015-8023","DLA-345-1","DSA-3398-1","EUVD-2015-7918","GHSA-4qm7-rm85-wr68","SUSE-SU-2015:2183-1","SUSE-SU-2015:2183-2","SUSE-SU-2015:2186-1","UBUNTU-CVE-2015-8023","USN-2811-1","openSUSE-SU-2024:10579-1"],"status":"published","title":"The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4...","description":"The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02582,"percentile":0.85319,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-264"],"published":"2015-11-16T00:00:00Z","modified":"2026-09-09T06:47:18Z","fixes":[{"ecosystem":"Debian:12","package":"strongswan","fixed_in":["5.3.3-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"strongswan","fixed_in":["5.3.3-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"strongswan","fixed_in":["5.3.3-3"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"strongswan","fixed_in":["4.4.1-5.8"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"strongswan","fixed_in":["4.5.2-1.5+deb7u8"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"strongswan","fixed_in":["5.2.1-6+deb8u2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"strongswan","fixed_in":["5.1.3-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12","package":"strongswan","fixed_in":["5.1.3-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"strongswan","fixed_in":["5.1.3-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"strongswan","fixed_in":["5.1.3-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"strongswan","fixed_in":["5.1.3-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"strongswan","fixed_in":["5.1.3-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 11 SP3","package":"strongswan","fixed_in":["4.4.0-6.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"strongswan","fixed_in":["4.4.0-6.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3","package":"strongswan","fixed_in":["4.4.0-6.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"strongswan","fixed_in":["4.4.0-6.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP3","package":"strongswan","fixed_in":["4.4.0-6.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"strongswan","fixed_in":["4.4.0-6.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"strongswan","fixed_in":["4.4.0-6.32.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"strongswan","fixed_in":["5.1.2-0ubuntu2.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"strongswan","fixed_in":["5.1.2-0ubuntu7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-3"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-5.8"}]}],"versions":["4.4.1-5.1","4.4.1-5.2","4.4.1-5.3","4.4.1-5.4","4.4.1-5.5","4.4.1-5.6","4.4.1-5.7"]},{"source":"osv","ecosystem":"Debian:7","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-1.5+deb7u8"}]}],"versions":["4.5.2-1.5+deb7u1","4.5.2-1.5+deb7u2","4.5.2-1.5+deb7u2~bpo60+1","4.5.2-1.5+deb7u3","4.5.2-1.5+deb7u3~bpo60+1","4.5.2-1.5+deb7u4","4.5.2-1.5+deb7u6","4.5.2-1.5+deb7u7"]},{"source":"osv","ecosystem":"Debian:8","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-6+deb8u2"}]}],"versions":["5.2.1-6","5.2.1-6+deb8u1","5.2.1-6+deb8u1~bpo70+1","5.2.1-6+deb8u2~bpo70+1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP3","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-6.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-6.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-6.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-6.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP3","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-6.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-6.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-6.32.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-0ubuntu2.4"}]}],"versions":["4.6.4-9","5.1.0-2","5.1.0-3","5.1.1-0ubuntu1","5.1.1-0ubuntu2","5.1.1-0ubuntu3","5.1.1-0ubuntu4","5.1.1-0ubuntu5","5.1.1-0ubuntu7","5.1.1-0ubuntu14","5.1.1-0ubuntu17","5.1.2~dr3+git20130120-0ubuntu2","5.1.2~dr3+git20130120-0ubuntu3","5.1.2~rc1-0ubuntu3","5.1.2~rc1-0ubuntu4","5.1.2~rc2-0ubuntu2","5.1.2-0ubuntu1","5.1.2-0ubuntu2","5.1.2-0ubuntu2.2","5.1.2-0ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-0ubuntu7"}]}],"versions":["5.1.2-0ubuntu6"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-0ubuntu2.4"}]}],"versions":["4.6.4-9","5.1.0-2","5.1.0-3","5.1.1-0ubuntu1","5.1.1-0ubuntu2","5.1.1-0ubuntu3","5.1.1-0ubuntu4","5.1.1-0ubuntu5","5.1.1-0ubuntu7","5.1.1-0ubuntu14","5.1.1-0ubuntu17","5.1.2~dr3+git20130120-0ubuntu2","5.1.2~dr3+git20130120-0ubuntu3","5.1.2~rc1-0ubuntu3","5.1.2~rc1-0ubuntu4","5.1.2~rc2-0ubuntu2","5.1.2-0ubuntu1","5.1.2-0ubuntu2","5.1.2-0ubuntu2.2","5.1.2-0ubuntu2.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.5-1.1"}]}],"bundled":11}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"strongswan","product":"strongswan"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00025.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://www.strongswan.org/blog/2015/11/16/strongswan-vulnerability-%28cve-2015-8023%29.html","tags":["x_refsource_CONFIRM","x_transferred","article"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-11/msg00139.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/84947","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.debian.org/security/2015/dsa-3398","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2811-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8023"},{"url":"https://www.strongswan.org/blog/2015/11/16/strongswan-vulnerability-(cve-2015-8023).html"},{"url":"https://github.com/advisories/GHSA-4qm7-rm85-wr68"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-8023","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20152183-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/953817","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8023","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20152183-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20152186-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-8023","tags":["report"]},{"url":"https://www.strongswan.org/blog/2015/11/16/strongswan-5.3.4-released.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2811-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8023","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4171","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-8023","description":"The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.","status":"published","published":"2015-11-18T16:00:00Z","modified":"2024-08-06T08:06:31.575Z","updated_at":"2026-11-02T14:35:40.900357Z"}],"euvd":[{"id":"EUVD-2015-7918","description":"The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.","status":"published","published":"2015-11-18T16:00:00Z","modified":"2024-08-06T08:06:31Z","updated_at":"2026-11-03T02:21:50.339607Z"}],"ghsa":[{"id":"GHSA-4qm7-rm85-wr68","title":"The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4...","description":"The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.","status":"published","published":"2022-05-14T03:07:25Z","modified":"2025-04-12T12:55:14Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:24.694642Z"}],"nvd":[{"id":"CVE-2015-8023","description":"The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.","status":"published","published":"2015-11-18T16:59:07.587Z","modified":"2026-06-17T00:33:53.07Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-264"],"updated_at":"2026-11-02T14:03:12.30866Z"}],"osv":[{"id":"CVE-2015-8023","description":"The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.","status":"published","published":"2015-11-18T16:59:07Z","modified":"2026-04-10T03:45:29.114744Z","updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-8023","description":"The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.","status":"published","published":"2015-11-18T16:59:07.587Z","modified":"2026-09-09T06:47:18.874742196Z","updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"DLA-345-1","title":"strongswan - security update","status":"published","published":"2015-11-19T00:00:00Z","modified":"2026-03-09T01:22:42.976665Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-3398-1","title":"strongswan - security update","status":"published","published":"2015-11-16T00:00:00Z","modified":"2026-03-09T01:20:36.48528Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"openSUSE-SU-2024:10579-1","title":"strongswan-5.3.5-1.1 on GA media","description":"These are all security issues fixed in the strongswan-5.3.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:32:44.74643Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2015:2183-1","title":"Security update for strongswan","description":"The strongswan package was updated to fix the following security issue:\n\n- CVE-2015-8023: Fixed an authentication bypass vulnerability in the eap-mschapv2 plugin (bsc#953817).\n","status":"published","published":"2015-12-21T19:00:13Z","modified":"2025-05-02T04:04:48.836829Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:2183-2","title":"Security update for strongswan","description":"The strongswan package was updated to fix the following security issue:\n\n- CVE-2015-8023: Fixed an authentication bypass vulnerability in the eap-mschapv2 plugin (bsc#953817).\n","status":"published","published":"2015-12-21T19:00:10Z","modified":"2025-05-02T04:04:48.895746Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:2186-1","title":"Security update for strongswan","description":"The strongswan package was updated to fix the following security issue:\n\n- CVE-2015-8023: Fixed an authentication bypass vulnerability in the eap-mschapv2 plugin (bsc#953817).\n","status":"published","published":"2015-12-03T13:45:53Z","modified":"2026-02-04T02:36:41.144335Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2015-8023","description":"The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.","status":"published","published":"2015-11-16T12:00:00Z","modified":"2026-02-04T03:22:07.074156Z","updated_at":"2026-11-02T15:54:10.737723Z"},{"id":"USN-2811-1","title":"strongswan vulnerability","description":"It was discovered that the strongSwan eap-mschapv2 plugin incorrectly\nhandled state. A remote attacker could use this issue to bypass\nauthentication.\n","status":"published","published":"2015-11-16T18:06:24Z","modified":"2026-02-10T04:40:56Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}