CVE-2015-8023: Canonical Ubuntu Linux

Medium severity, CVSS 5.0. EPSS: 2.6% chance of exploitation in the next 30 days.

The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 15.04 only; version 15.10 only
• Strongswan Strongswan: version 4.2.12 only; version 4.2.13 only; version 4.2.14 only; version 4.2.15 only; version 4.2.16 only; version 4.3.0 only; …

Published 2015-11-18. Last modified 2026-06-17.