CVE-2009-2661 — Strongswan vulnerability

4 documents4 sources
Severity
5.0MEDIUMNVD
EPSS
1.8%
top 17.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
StrongswanDebian Strongswan
Timeline
PublishedAug 4
Latest updateMay 2

Description

The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/strongswan< strongswan 4.3.2-1.1 (bookworm)
▶Debianstrongswan/strongswan< 4.3.2-1.1+3
▶NVDstrongswan/strongswan24 versions+23

Patches

Patch: download.strongswan.org ↗Patch: lists.strongswan.org ↗Patch: download.strongswan.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-7j3p-ffqc-xjpg: The asn1_length function in strongSwan 2↗2022-05-02
▶
OSV
CVE-2009-2661: The asn1_length function in strongSwan 2↗2009-08-04
▶

📋Vendor Advisories

1
Debian
CVE-2009-2661: strongswan - The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and...↗2009
▶