-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512


MITRE mistakenly issues CVE-2016-5361 for libreswan

Libreswan performs some additional hardening for the IKEv1 protocol to
prevent flaws in the IKEv1 protocol from being used in amplification
attacks. Other implementations that have not implemented such hardening,
have not been issued a CVE and this CVE has not been expanded to list
those other vendors.

The Libreswan Project believes this CVE should have been issued for
multiple vendors or for the IKE protocol itself, and that MITR should
not have singled out libreswan for actually hardening against this fault.
See discussion at:

http://www.openwall.com/lists/oss-security/2016/06/13/4
http://www.openwall.com/lists/oss-security/2016/06/14/8
http://www.openwall.com/lists/oss-security/2016/07/12/7

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1


EhAjJzA2pckjaIrZYydm
=Tyl3
-----END PGP SIGNATURE-----
