CVE-2011-4073 — Use After Free in Openswan

CWE-399 CWE-416 — Use After Free5 documents5 sources

Severity

4.0MEDIUMNVD

EPSS

1.1%

top 21.50%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Xelerance Openswan

Timeline

PublishedNov 17

Latest updateMay 14

Description

Use-after-free vulnerability in the cryptographic helper handler functionality in Openswan 2.3.0 through 2.6.36 allows remote authenticated users to cause a denial of service (pluto IKE daemon crash) via vectors related to the (1) quick_outI1_continue and (2) quick_outI1 functions.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 8.0 | Impact: 2.9

Affected Packages1 packages

▶NVDxelerance/openswan71 versions+70

🔴Vulnerability Details

GHSA

GHSA-p53h-4vvv-85x4: Use-after-free vulnerability in the cryptographic helper handler functionality in Openswan 2↗2022-05-14

▶

📋Vendor Advisories

Red Hat

openswan: use-after-free vulnerability leads to DoS↗2011-10-28

▶

💬Community

Bugzilla

CVE-2011-4073 openswan: use-after-free vulnerability leads to DoS↗2011-10-25

▶