new file mode 100644
@@ -0,0 +1,55 @@
+From 4dae392b32a2c56441fd7ca50ad32a0874455995 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Fri, 19 Jun 2026 11:57:48 +0200
+Subject: [PATCH] x509: Avoid NULL-pointer dereference if issuerName is missing
+ in attribute certificate
+
+If neither authoritiyKeyIdentifier nor issuerName are encoded in an
+attribute certificate, the validation in `acert_validator.c:verify()`
+will cause a NULL-pointer dereference via `issued_by()` (the lookup
+with NULL identity will enumerate all trusted certificates).
+
+Fixes: 26930a8c3e42 ("certificate factory can load certs from file")
+Fixes: CVE-2026-78130
+
+Origin: https://download.strongswan.org/security/CVE-2026-78130/strongswan-5.1.3-6.0.7_x509_ac_issuer_null.patch
+Reviewed-by: Simon Quigley <tsimonq2@debian.org>
+Last-Update: 2026-10-26
+
+CVE: CVE-2026-78130
+Upstream-Status: Backport [https://download.strongswan.org/security/CVE-2026-78130/strongswan-5.1.3-6.0.7_x509_ac_issuer_null.patch]
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ src/libstrongswan/plugins/x509/x509_ac.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c
+index 2e370f5..a0b6cc3 100644
+--- a/src/libstrongswan/plugins/x509/x509_ac.c
++++ b/src/libstrongswan/plugins/x509/x509_ac.c
+@@ -913,7 +913,11 @@ METHOD(certificate_t, has_issuer, id_match_t,
+ {
+ return ID_MATCH_PERFECT;
+ }
+- return this->issuerName->matches(this->issuerName, issuer);
++ if (this->issuerName)
++ {
++ return this->issuerName->matches(this->issuerName, issuer);
++ }
++ return ID_MATCH_NONE;
+ }
+
+ METHOD(certificate_t, issued_by, bool,
+@@ -950,7 +954,8 @@ METHOD(certificate_t, issued_by, bool,
+ }
+ else
+ {
+- if (!this->issuerName->equals(this->issuerName,
++ if (!this->issuerName ||
++ !this->issuerName->equals(this->issuerName,
+ issuer->get_subject(issuer)))
+ {
+ return FALSE;
+--
+2.50.1
+
new file mode 100644
@@ -0,0 +1,77 @@
+From d925e4625626a70611a979d4ab231c6e2d313e4a Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Wed, 1 Jul 2026 16:24:23 +0200
+Subject: [PATCH] x509: Prevent infinite loop when parsing ietfAttrSyntax in
+ attribute certificates
+
+This is the same issue that was fixed with 407fcca200fd ("asn1-parser:
+Fix CHOICE parsing") for other CHOICE elements. This one was missed and
+can be triggered pre-auth by sending an attribute certificate to a peer.
+Since it's parsed before verifying it, the certificate doesn't have to
+be valid.
+
+For versions older than 5.5.3, this patch requires prior application of
+the fix for CVE-2017-9023, which introduced proper CHOICE handling in
+the ASN.1 parser.
+
+Fixes: a17598bc6992 ("x509: Integrate IETF attribute handling, and obsolete ietf_attributes_t")
+Fixes: CVE-2026-78132
+
+CVE: CVE-2026-78132
+Upstream-Status: Backport [https://download.strongswan.org/security/CVE-2026-78132/strongswan-5.1.3-6.0.7_x509_ac_ietfattr_loop.patch]
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ src/libstrongswan/plugins/x509/x509_ac.c | 36 +++++++++++-------------
+ 1 file changed, 17 insertions(+), 19 deletions(-)
+
+diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c
+index a0b6cc3..3b04542 100644
+--- a/src/libstrongswan/plugins/x509/x509_ac.c
++++ b/src/libstrongswan/plugins/x509/x509_ac.c
+@@ -265,26 +265,24 @@ static void parse_roleSyntax(chunk_t blob, int level0)
+ */
+ static const asn1Object_t ietfAttrSyntaxObjects[] =
+ {
+- { 0, "ietfAttrSyntax", ASN1_SEQUENCE, ASN1_NONE }, /* 0 */
+- { 1, "policyAuthority", ASN1_CONTEXT_C_0, ASN1_OPT |
+- ASN1_BODY }, /* 1 */
+- { 1, "end opt", ASN1_EOC, ASN1_END }, /* 2 */
+- { 1, "values", ASN1_SEQUENCE, ASN1_LOOP }, /* 3 */
+- { 2, "octets", ASN1_OCTET_STRING, ASN1_OPT |
+- ASN1_BODY }, /* 4 */
+- { 2, "end choice", ASN1_EOC, ASN1_END }, /* 5 */
+- { 2, "oid", ASN1_OID, ASN1_OPT |
+- ASN1_BODY }, /* 6 */
+- { 2, "end choice", ASN1_EOC, ASN1_END }, /* 7 */
+- { 2, "string", ASN1_UTF8STRING, ASN1_OPT |
+- ASN1_BODY }, /* 8 */
+- { 2, "end choice", ASN1_EOC, ASN1_END }, /* 9 */
+- { 1, "end loop", ASN1_EOC, ASN1_END }, /* 10 */
+- { 0, "exit", ASN1_EOC, ASN1_EXIT }
++ { 0, "ietfAttrSyntax", ASN1_SEQUENCE, ASN1_NONE }, /* 0 */
++ { 1, "policyAuthority", ASN1_CONTEXT_C_0, ASN1_OPT|ASN1_BODY }, /* 1 */
++ { 1, "end opt", ASN1_EOC, ASN1_END }, /* 2 */
++ { 1, "values", ASN1_SEQUENCE, ASN1_LOOP }, /* 3 */
++ { 2, "value choice", ASN1_EOC, ASN1_CHOICE }, /* 4 */
++ { 3, "octets", ASN1_OCTET_STRING, ASN1_OPT|ASN1_BODY }, /* 5 */
++ { 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 6 */
++ { 3, "oid", ASN1_OID, ASN1_OPT|ASN1_BODY }, /* 7 */
++ { 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 8 */
++ { 3, "string", ASN1_UTF8STRING, ASN1_OPT|ASN1_BODY }, /* 9 */
++ { 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 10 */
++ { 2, "end choices", ASN1_EOC, ASN1_END|ASN1_CHOICE }, /* 11 */
++ { 1, "end loop", ASN1_EOC, ASN1_END }, /* 12 */
++ { 0, "exit", ASN1_EOC, ASN1_EXIT }
+ };
+-#define IETF_ATTR_OCTETS 4
+-#define IETF_ATTR_OID 6
+-#define IETF_ATTR_STRING 8
++#define IETF_ATTR_OCTETS 5
++#define IETF_ATTR_OID 7
++#define IETF_ATTR_STRING 9
+
+ /**
+ * Parse group memberships, IETF attributes
+--
+2.50.1
+
@@ -18,6 +18,8 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
file://constraints-Case-insensitive-matching-and-reject-exc.patch \
file://tls-server-Only-accept-non-empty-ECDH-public-keys-wi.patch \
file://libradius-Reject-undersized-attributes-in-enumerator.patch \
+ file://CVE-2026-78130.patch \
+ file://CVE-2026-78132.patch \
"
SRC_URI[sha256sum] = "728027ddda4cb34c67c4cec97d3ddb8c274edfbabdaeecf7e74693b54fc33678"
Pick patch according to [1] & [2] which is also mentioned at Debian report in [3] & [4]. [1] https://download.strongswan.org/security/CVE-2026-78130/ [2] https://download.strongswan.org/security/CVE-2026-78132/ [3] https://security-tracker.debian.org/tracker/CVE-2026-78130 [4] https://security-tracker.debian.org/tracker/CVE-2026-78132 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> --- .../strongswan/CVE-2026-78130.patch | 55 +++++++++++++ .../strongswan/CVE-2026-78132.patch | 77 +++++++++++++++++++ .../strongswan/strongswan_5.9.14.bb | 2 + 3 files changed, 134 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch