Tobias Brunner dd6a984afb xauth-generic: Make sure to only use secrets that match the username ...

This ensures that secrets that are associated with the server identity,
usually they are assigned to the username exclusively, will only be tried
if the username also matched.  Otherwise, it could be possible for users
who know at least one password to impersonate another user.

Fixes: 462c9a4f72 ("Try all matching XAuth secrets we find, not only the first one")

2026-07-24 08:47:38 +02:00

..

addrblock

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

android_dns

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

android_log

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

attr

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

attr_sql

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

bypass_lan

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

certexpire

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

connmark

connmark: Fix undefined shift if traffic selector is /0

2026-07-24 08:47:36 +02:00

counters

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

coupling

coupling: Avoid potential access by multiple threads to shared hasher

2026-07-23 10:26:08 +02:00

dhcp

dhcp: Make sure to only modify transactions after receiving an expected DHCP OFFER

2026-07-24 08:47:35 +02:00

dnscert

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

duplicheck

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

eap_aka

eap-aka: Make sure AT_RAND has the correct length in AKA-Challenge

2026-06-04 11:31:11 +02:00

eap_aka_3gpp

eap-aka-3gpp: Fix length when logging AUTS and increase some log levels

2026-07-24 08:47:36 +02:00

eap_aka_3gpp2

eap-aka-3gpp2: Log potentially sensitive material on level 4

2026-07-24 08:47:36 +02:00

eap_dynamic

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

eap_gtc

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

eap_identity

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

eap_md5

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

eap_mschapv2

eap-mschapv2: Remove retry after failed attempts

2026-07-23 10:26:08 +02:00

eap_peap

eap-peap: Don't allow authenticated client to skip EAP-TNC with unexpected EAP-SUCCESS

2026-07-23 10:26:08 +02:00

eap_radius

eap-radius: Limit number of concurrently cached DAE responses

2026-07-24 08:47:38 +02:00

eap_sim

eap-sim: Prevent infinite loop if version list contains more than one entry

2026-04-02 08:17:04 +02:00

eap_sim_file

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

eap_sim_pcsc

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

eap_simaka_pseudonym

eap-simaka-pseudonym: Prevent corrupting hashtables during concurrent accesses

2026-07-23 10:26:08 +02:00

eap_simaka_reauth

eap-simaka-reauth: Prevent corrupting hashtables during concurrent accesses

2026-07-23 10:26:08 +02:00

eap_simaka_sql

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

eap_tls

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

eap_tnc

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

eap_ttls

eap-ttls: Add an upper bound for the length of the parsed AVP

2026-07-24 08:47:36 +02:00

error_notify

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

ext_auth

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

farp

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

forecast

forecast: Fix undefined shift if traffic selector is /0

2026-07-24 08:47:36 +02:00

ha

ha: Make receive buffer size for the HA socket configurable

2026-07-21 10:21:51 +02:00

ipseckey

oid: Fix confusing identifiers for elliptic curves over prime fields

2026-05-28 13:30:07 +02:00

kernel_iph

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

kernel_libipsec

kernel-libipsec: Remove exclude route (reference) if route is updated

2026-07-23 10:26:08 +02:00

kernel_netlink

kernel-netlink: Add some safety checks when printing extended error messages

2026-07-24 08:47:36 +02:00

kernel_pfkey

kernel-pfkey: Remove exclude route (reference) if route is updated

2026-07-23 10:26:08 +02:00

kernel_pfroute

kernel-pfroute: Remove IP addresses from hashtable if interface disappears

2026-07-24 08:47:37 +02:00

kernel_wfp

kernel-wfp: Add support for SA deletion in either order

2026-07-24 08:47:38 +02:00

led

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

load_tester

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

lookip

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

medcli

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

medsrv

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

osx_attr

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

p_cscf

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

radattr

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

resolve

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

save_keys

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

selinux

ike: Use correct format string for unique Child SA identifiers

2026-04-16 15:32:54 +02:00

smp

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

socket_default

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

socket_dynamic

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

socket_win

socket-win: Bind the sockets exclusively

2026-07-24 08:47:37 +02:00

sql

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

stroke

ike: Use correct format string for unique Child SA identifiers

2026-04-16 15:32:54 +02:00

systime_fix

systime-fix: Unregister validator also if time got valid

2026-07-24 08:47:36 +02:00

tnc_ifmap

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

tnc_pdp

tnc-pdp: Fix lock type when adding/replacing a connection

2026-07-23 10:26:08 +02:00

unity

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

updown

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

vici

vici: Also wipe cached PINs during clear-creds command

2026-07-24 08:47:37 +02:00

whitelist

whitelist: Fix deadlock when handling client disconnection

2026-02-20 12:44:55 +01:00

xauth_eap

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

xauth_generic

xauth-generic: Make sure to only use secrets that match the username

2026-07-24 08:47:38 +02:00

xauth_noauth

Define plugin version in all existing plugins

2025-08-22 15:32:39 +02:00

xauth_pam

xauth-pam: Properly initialize response array when handling sessions

2026-07-24 08:47:36 +02:00