Re: [meta-lts-collab][kirkstone][PATCH V2 1/7] strongswan: Fix CVE-2026-35328

On Tue, Jun 23, 2026 at 01:10 AM, Nitin Wankhade wrote:

> 
> From: Nitin Wankhade <[email protected]>
> 
> Upstream-Status: Backport [ https://snapshot.debian.org/archive/debian-security-debug/20260422T125423Z/pool/updates/main/s/strongswan/strongswan_6.0.1-6%2Bdeb13u5.debian.tar.xz
> ]
> 
> Signed-off-by: Nitin Wankhade <[email protected]>
> ---
> .../strongswan/files/CVE-2026-35328.patch | 42 +++++++++++++++++++
> .../strongswan/strongswan_5.9.13.bbappend | 4 ++
> 2 files changed, 46 insertions(+)
> create mode 100644
> meta-networking/recipes-support/strongswan/files/CVE-2026-35328.patch
> create mode 100644
> meta-networking/recipes-support/strongswan/strongswan_5.9.13.bbappend
> 
> diff --git
> a/meta-networking/recipes-support/strongswan/files/CVE-2026-35328.patch
> b/meta-networking/recipes-support/strongswan/files/CVE-2026-35328.patch
> new file mode 100644
> index 0000000..32a23b3
> --- /dev/null
> +++
> b/meta-networking/recipes-support/strongswan/files/CVE-2026-35328.patch
> @@ -0,0 +1,42 @@
> +From: Tobias Brunner <[email protected]>
> +Date: Wed, 25 Mar 2026 10:17:46 +0100
> +Subject: tls-server: Prevent infinite loop if supported versions are too
> + short
> +
> +If the extension doesn't contain a multiple of two bytes, the previous
> +code would get stuck in an infinite loop as `remaining()` continued to
> +return TRUE while `read_uint16()` failed to parse a value. Initiating
> +several connections with such an extension allows a DoS attack as no
> +threads would eventually be available to handle packets/events.
> +
> +Fixes: 7fbe2e27ecf6 ("tls-server: TLS 1.3 support for TLS server
> implementation")
> +Fixes: CVE-2026-35328
> +
> +CVE: CVE-2026-35328
> +Upstream-Status: Backport [ https://snapshot.debian.org/archive/debian-security-debug/20260422T125423Z/pool/updates/main/s/strongswan/strongswan_6.0.1-6%2Bdeb13u5.debian.tar.xz
> ]
> +Signed-off-by: Nitin Wankhade <[email protected]>

For all the patches in this series, could you please include direct links to the backport patches instead of attaching a tar file?
e.g: https://github.com/strongswan/strongswan/commit/56c7f0d13dffcfebf4255470e375234144d28134 for CVE-2026-35328