CVE and update status of the FreeBSD ports tree3,296 unaddressed CVEs in 671 portsAll times are CET
Port details

security/strongswan 6.1.0

Open Source IKEv2 IPsec-based VPN solution

Port info

Maintainer
rcm@FreeBSD.org
Packages
latest: 6.1.0
Upstream
up to date
Last update
to 6.1.0 · 5a7f75878c
Quarterly
2026Q4: 6.1.0
WWW
https://www.strongswan.org
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install strongswan
installs 6.1.0 from latest; from quarterly (2026Q4) 6.1.0
Port
# cd /usr/ports/security/strongswan && make install clean
# make -C /usr/ports/security/strongswan config  # change options first
Size
897 KiB download · 2.7 MiB installed
Depends on
ftp/curl 8.23.0
License
GPLv2
Options
10 of 36 on in the package: BUILTIN CURL GCM IKEV1 KDF KERNELLIBIPSEC ML PKI SWANCTL VICI
Show the 26 options that are off
CTR DHCP EAPAKA3GPP2 EAPDYNAMIC EAPRADIUS EAPSIMFILE FARP FIPS_PRF IPSECKEY LDAP LIBC LOADTESTER MEDIATION MYSQL PKCS11 PYTHON SMP SQLITE STROKE TESTVECTOR TPM TSS2 UNBOUND UNITY VSTR XAUTH
pkg-message
Shown after installing
The default strongSwan configuration interface have been updated to vici since version 5.9.2_1.
To use the stroke interface by default either compile the port without the vici option or
set 'strongswan_interface="stroke"' in your rc.conf file.
Shown after upgrading
The default strongSwan configuration interface have been updated to vici.
To use the stroke interface by default either compile the port without the vici option or
set 'strongswan_interface="stroke"' in your rc.conf file.

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 166.1.06.1.0–
FreeBSD 156.1.06.1.0–
FreeBSD 146.1.06.1.06.1.0

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 156.1.06.1.0–
FreeBSD 146.1.06.1.06.1.0

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 6.1.0.

Fixed (27)

Show 27 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVECVSSPublishedDescription
CVE-2026-781307.52026-09-11strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser.
CVE-2026-781327.52026-09-11strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.
CVE-2026-781337.52026-09-11libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling.
CVE-2026-781347.12026-09-11strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity.
CVE-2026-781295.92026-09-11strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.
CVE-2026-781235.92026-09-11strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin.
CVE-2026-781265.92026-09-11strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin.
CVE-2026-781273.72026-09-11libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.
CVE-2026-781313.72026-09-11strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser.
CVE-2026-781243.72026-09-11strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (119)

Baptiste Daroussin (bapt) · 5.2.0_1
Simplify plist
2bbe2b3d55
Dmitry Marakasov (amdmi3) · 5.2.0_1
- Switch dns/unbound to USES=libtool, drop .la files - Bump dependent ports as .so version has changed - While here, add LICENSE_FILE to dns/getdns

Approved by:	portmgr blanket
13ab9a72d8
John Marino (marino) · 5.2.0
security/strongswan: Upgrade version 5.1.3 => 5.2.0

While here, including missing library files and use install-strip
target.  Maintainer added a crash fix patch while reviewing.

PR:		192366
Submitted by:	dewayne (heruristicssystems.com.au)
Approved by:	maintainer (strongswan nanoteq.com)
6f463327e8
Tijl Coosemans (tijl) · 5.1.3_2
net/openldap24-*: - Convert to USES=libtool and bump dependent ports - Avoid USE_AUTOTOOLS - Don't use PTHREAD_LIBS - Use MAKE_CMD

databases/glom:
- Drop :keepla
- Add INSTALL_TARGET=install-strip

databases/libgda4* databases/libgda5*:
- Convert to USES=libtool and bump dependent ports
- USES=tar:xz
- Use INSTALL_TARGET=install-strip
- Use @sample

databases/libgdamm:
- Drop :keepla
- USES=tar:bzip2
- Use INSTALL_TARGET=install-strip

databases/libgdamm5:
- Add INSTALL_TARGET=install-strip
- Drop --enable-static (inherited from old repocopy)

devel/anjuta x11-toolkits/py-gnome-extras:
- Drop :keepla

dns/powerdns dns/powerdns-devel:
- Convert to USES=libtool
- Add INSTALL_TARGET=install-strip
- Disable static modules
- Stop creating library symlinks with .0 suffix, not needed for dynamically
  opened modules

mail/dovecot2:
- Add USES=libtool

mail/dovecot2-pigeonhole:
- Drop CONFIGURE_TARGET (incorrect for Dragonfly)
- Add USES=libtool and INSTALL_TARGET=install-strip

math/gnumeric:
- USES=libtool tar:xz

Approved by:	portmgr (implicit, bump unstaged ports)
37f54e0f66
Martin Wilke (miwi) · 5.1.3_1
- Chase database/sqlite3 slib bump

Approved by:	portmgr (myself)
bd48d39657
Kurt Jaeger (pi) · 5.1.3
security/strongswan: update 5.1.1 -> 5.1.3 with security update

- Update strongSwan port to 5.1.3 to resolve CVE 2014-2338
- Fixed rcvar issue with FreeBSD 10 (ports/186865)
- Added building of additional tools included in strongswan (ports/186867)
- libtool fix
- pkg-plist updated

PR:             ports/189132, ports/186865, ports/186867
Submitted by:   Robert Sevat, Dewayne Geraghty, Francois ten Krooden (maintainer)
Approved by:    jadawin (mentor)
87798b4974
Bernhard Froehlich (decke) · 5.1.1_1
- Use OPTIONS_SUB=yes - Prefer ${INSTALL_DATA} over ${MV} - Whitespace fix

Thanks to:	garga@
de452c484c
Antoine Brodin (antoine) · 5.1.1_1
- Remove MANx, man pages are already moved to plist - Use new LIB_DEPENDS syntax
30100f3566
Bernhard Froehlich (decke) · 5.1.1_1
- Add missing manpages

PR:		ports/186264
Submitted by:	HASHI Hiroaki <hashiz@meridiani.jp>
Approved by:	strongswan <strongswan@Nanoteq.com> (maintainer)
2b99a9e08b
Bernhard Froehlich (decke) · 5.1.1
- Update to 5.1.1 - Added EAP dynamic proxy module - Added EAP Radius proxy authentication - Added DNSSEC/unbound support - Added kernel libipsec plugin - Changed configuration files to install to ${PREFIX}/etc/<filename>.conf.sample - Convert to new options format

PR:		ports/185535
Submitted by:	Francois ten Krooden <strongswan@nanoteq.com> (maintainer)
Security:	CVE-2013-5018
Security:	CVE-2013-6075
Security:	CVE-2013-6076
6ab93ec3c7
Baptiste Daroussin (bapt) · 5.0.4_1
Add NO_STAGE all over the place in preparation for the staging support (cat: security)
a65ed2e51b
Sunpoet Po-Chuan Hsieh (sunpoet) · 5.0.4_1
- Update to 7.31.0 - Bump PORTREVISION for ftp/curl shlib change - Add TEST_DEPENDS - Convert to new options framework - Adjust options:   - Add COOKIES   - Add CYASSL, NSS, POLARSSL, THREADED_RESOLVER, TLS_SRP [1]   - Add GSSAPI and SPNEGO [2]   - Remove KERBEROS4   - Rename LIBIDN to IDN   - Remove TRACKMEMORY [1] - Sort option handler - Add SLAVEDIRS: ftp/curl-hiphop - Cosmetic change - Cleanup

Changes:	http://curl.haxx.se/changes.html
PR:		ports/172325 (-exp run), ports/177369 (based on) [1]
Submitted by:	Hirohisa Yamaguchi <umq@ueo.co.jp> [1], hrs (via email) [2]
Exp run by:	miwi
c2d1a14c7c
Olli Hauer (ohauer) · 5.0.4
- update to version 5.0.4 which fixes CVE-2013-2944. - add entry to vuxml - add CVE references to jankins vuxml entry

while I'm here remove .sh from rc script

PR:		ports/178266
Submitted by:	David Shane Holden <dpejesh@yahoo.com>
Approved by:	strongswan@nanoteq.com (maintainer)
7ee3843173
TAKATSU Tomonari (tota) · 5.0.1
- Update to 5.0.1 - Change maintainer address - Trim Makefile header - Convert to new options framework - Cleanup

PR:		ports/173860 (based on)
Submitted by:	Riaan Kruger (maintainer)
e62bbe9b89
Doug Barton (dougb) · 4.5.3
In the rc.d scripts, change assignments to rcvar to use the literal name_enable wherever possible, and ${name}_enable when it's not, to prepare for the demise of set_rcvar().

In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.
83eb2c3700
Florian Smeets (flo) · 4.5.3
update to 4.5.3

PR:		ports/160401
Submitted by:	Riaan Kruger <riaank@gmail.com> maintainer
cd017dcb5b
Frederic Culot (culot) · 4.5.1
- Update to 4.5.1 [1] - Pet portlint(1) (change spaces into tabs and reformat IGNORE message)

PR:		ports/156711 [1]
Submitted by:	Riaan Kruger <riaank@gmail.com> (maintainer)
194b2ba99d
Ade Lovett (ade) · 4.4.0
Sync to new bsd.autotools.mk
4a8684e352
Pav Lucistnik (pav) · 4.4.0
Strongswan is an open source IPsec-based VPN solution. Strongswan for FreeBSD supports IKEv2 but NOT IKEv1.

WWW: http://www.strongswan.org

PR:		ports/147431
Submitted by:	Riaan Kruger <riaank@gmail.com>
8a9429cb2b