StrongSwan 5.9.4 dr2

CPE Details

StrongSwan 5.9.4 dr2
strongswan
strongswan
5.9.4
2022-10-31
12h54 +00:00
2022-10-31
13h19 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:strongswan:strongswan:5.9.4:dr2:*:*:*:*:*:*

Informations

Vendor

strongswan

Product

strongswan

Version

5.9.4

Update

dr2

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2023-41913 2023-12-06 23h00 +00:00 strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.
9.8
Critique
CVE-2022-40617 2022-10-30 23h00 +00:00 strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA) certificate that contains a CRL/OCSP URL that points to a server (under the attacker's control) that doesn't properly respond but (for example) just does nothing after the initial TCP handshake, or sends an excessive amount of application data.
7.5
Haute
CVE-2021-45079 2022-01-31 06h15 +00:00 In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
9.1
Critique