new file mode 100644
@@ -0,0 +1,53 @@
+From 2918eb8a6d4b3167f26ac011e87c3a7ecc7dbe56 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Mon, 1 Jun 2026 17:51:35 +0200
+Subject: [PATCH] openssl: Fix undefined memory access when verifying PKCS#7
+ containers
+
+If the signerInfo or recipientInfo structure doesn't contain
+issuerAndSerialNumber but instead a subjectKeyIdentifier, then the called
+functions will leave the passed name and serial numbers unchanged. While
+openssl_x509_name2id() prevents a NULL-pointer dereference, it tries to
+DER-encode the object at the passed pointer via i2d_X509_NAME().
+Depending on the stack contents, this likely causes a segmentation fault.
+
+Fixes: 3c820cdc232a ("Implement PKCS#7 decryption using openssl")
+Fixes: c61723c69fb5 ("Implement OpenSSL PKCS#7 signed-data parsing and verification")
+Fixes: CVE-2026-78123
+CVE: CVE-2026-78123
+Upstream-Status: Backport [https://download.strongswan.org/security/CVE-2026-78123/]
+Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
+
+---
+ src/libstrongswan/plugins/openssl/openssl_pkcs7.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
+index 73611821aadb..9980bf242c12 100644
+--- a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
++++ b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
+@@ -222,8 +222,8 @@ static auth_cfg_t *verify_signature(CMS_SignerInfo *si,
+ auth_cfg_t *auth, *found = NULL;
+ identification_t *issuer, *serial;
+ chunk_t attrs = chunk_empty, sig, attr;
+- X509_NAME *name;
+- ASN1_INTEGER *snr;
++ X509_NAME *name = NULL;
++ ASN1_INTEGER *snr = NULL;
+ int i;
+
+ if (CMS_SignerInfo_get0_signer_id(si, NULL, &name, &snr) != 1)
+@@ -633,8 +633,8 @@ static bool decrypt(private_openssl_pkcs7_t *this,
+ identification_t *serial, *issuer;
+ private_key_t *private;
+ X509_ALGOR *alg;
+- X509_NAME *name;
+- ASN1_INTEGER *sn;
++ X509_NAME *name = NULL;
++ ASN1_INTEGER *sn = NULL;
+ u_char zero = 0;
+ int oid;
+
+--
+2.43.0
+
@@ -10,7 +10,8 @@ DEPENDS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', ' tpm2-tss',
SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
file://CVE-2026-47895.patch \
-"
+ file://CVE-2026-78123.patch \
+ "
SRC_URI[sha256sum] = "07df7cedae56a7f3bb07e66d21a1f9f87e961db70e99184e11d3819413e4f87c"
strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin. Reference: [https://nvd.nist.gov/vuln/detail/cve-2026-78123] [https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78123).html] [https://security-tracker.debian.org/tracker/CVE-2026-78123] Upstream Patch: [https://download.strongswan.org/security/CVE-2026-78123/] Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com> --- .../strongswan/CVE-2026-78123.patch | 53 +++++++++++++++++++ .../strongswan/strongswan_6.0.6.bb | 3 +- 2 files changed, 55 insertions(+), 1 deletion(-) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch