1.1.7 has 4.5.2-1.1-bpo60+vyos1+helium4. We should apply 2 patches, CVE-2015-4171 and CVE-2015-8023 to vyatta-strongswan helium branch.

• https://www.cvedetails.com/cve/CVE-2014-2338/
  • Already fixed by https://github.com/vyos/vyatta-strongswan/commit/a2ca1c992957073dfb7e1663601aa2e574f97386
• https://www.cvedetails.com/cve/CVE-2014-2891/
  • Already fixed by https://github.com/vyos/vyatta-strongswan/commit/96c4e0c4290259f20d92946eca9cb6701b18184f
• https://www.cvedetails.com/cve/CVE-2015-4171/
  • Patch: https://download.strongswan.org/security/CVE-2015-4171/
• https://www.cvedetails.com/cve/CVE-2015-8023/
  • Patch: https://download.strongswan.org/security/CVE-2015-8023/
  • Already applied to lithium branch: https://github.com/vyos/vyatta-strongswan/commit/d2b4c6bfbcf25eebf80c5f29bfd7217b1e31865f
• https://www.cvedetails.com/cve/CVE-2017-9022/
  • 4.5.2 is not affected
• https://www.cvedetails.com/cve/CVE-2017-9023/
  • 4.5.2 is not affected
• https://www.cvedetails.com/cve/CVE-2014-9221/
  • 4.5.2 is not affected

The CVSS score of CVE-2015-4171 is low, and it needs a valid certificate for attack. Can we ignore CVE-2015-4171?

I applied the patch for CVE-2015-8023 to helium branch. https://github.com/vyos/vyatta-strongswan/commit/1f431fed4988a5e7f20a3f8ab464fed85c5f7e1c

Jenkins job is broken. https://ci.vyos.net/job/vyatta-strongswan/

Packages for testing:

Hey @higebu!
agree on CVE-2015-4171

@dmbaturin moving build system to other host due to space restrictions

@syncer I guess we need Squeeze host for building packages. But if we use pbuilder, we can build packages on Jessie.
Example script is here: https://gist.github.com/higebu/139c786fab3c88113d54eef16b462655

I installed squeeze, think @dmbaturin will add it to CI once it ready

Good!

@higebu @syncer squeeze is added to ci, only there is no repo to upload.

@UnicronNL The debian repo for helium is here: http://dev.packages.vyos.net/legacy/repos/debian/helium/