The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries. The code attempts to select a less-often-used cache entry by means of a random number generator, but this is not done correctly. Remote code execution might be a slight possibility.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade strongswan | Mar 26, 2024 | Oct 18, 2021 |
| Debian | — | Upgrade strongswan | Nov 29, 2021 | Oct 18, 2021 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Freebsd | — | Upgrade strongswan | Nov 4, 2022 | Jan 25, 2022 |
| Gentoo Linux | — | Upgrade net-vpn/strongswan. | May 6, 2024 | Oct 18, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade strongimcv | May 25, 2022 | Oct 18, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade strongimcv | Mar 22, 2022 | Oct 18, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 18, 2021 |
| Suse | — | Upgrade strongswan-nmUpgrade strongswanUpgrade strongswan-docUpgrade strongswan-sqliteUpgrade strongswan-ipsecUpgrade strongswan-mysqlUpgrade strongswan-libs0Upgrade strongswan-hmac | Oct 20, 2021 | Oct 18, 2021 |
| Ubuntu | — | Upgrade strongswan (Ubuntu Pro)Upgrade strongswanUpgrade libstrongswanUpgrade libstrongswan (Ubuntu Pro) | Oct 20, 2021 | Oct 18, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 18, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub