The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries. The code attempts to select a less-often-used cache entry by means of a random number generator, but this is not done correctly. Remote code execution might be a slight possibility.
The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries. The code attempts to select a less-often-used cache entry by means of a random number generator, but this is not done correctly. Remote code execution might be a slight possibility.
The gmp plugin in strongSwan before version 5.9.4 has a remote integer overflow vulnerability via a crafted certificate with an RSASSA-PSS signature. For example, this can be triggered by an unrelated self-signed CA certificate sent by an initiator. Remote code execution cannot occur. The in-memory certificate cache in strongSwan before version 5.9.4 has a remote integer overflow vulnerability upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries. The code attempts to select a less-often-used cache entry by means of a random number generator, but this is not done correctly. This could lead to a denial of service (DoS) condition. Remote code execution can't be excluded completely, but it would require attackers to have control over the dereferenced memory, so it is very unlikely.
Affected: openEuler:20.03-LTS-SP1: strongswan, openEuler:20.03-LTS-SP2: strongswan
The strongSwan IPsec implementation supports both the IKEv1 and IKEv2 key exchange protocols in conjunction with the native NETKEY IPsec stack of the Linux kernel. Security Fix(es): The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. For example, this can be triggered by an unrelated self-signed CA certificate sent by an initiator. Remote code execution cannot occur.(CVE-2021-41990) The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries. The code attempts to select a less-often-used cache entry by means of a random number generator, but this is not done correctly. Remote code execution might be a slight possibility.(CVE-2021-41991)
Security update for strongswan
Security update for strongswan
Affected: Ubuntu:Pro:14.04:LTS: strongswan, Ubuntu:Pro:16.04:LTS: strongswan, Ubuntu:Pro:FIPS:16.04:LTS: strongswan, Ubuntu:18.04:LTS: strongswan, Ubuntu:Pro:FIPS-updates:18.04:LTS: strongswan, Ubuntu:Pro:FIPS:18.04:LTS: strongswan, Ubuntu:20.04:LTS: strongswan, Ubuntu:Pro:FIPS-updates:20.04:LTS: strongswan, Ubuntu:Pro:FIPS:20.04:LTS: strongswan, Ubuntu:22.04:LTS: strongswan
The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries. The code attempts to select a less-often-used cache entry by means of a random number generator, but this is not done correctly. Remote code execution might be a slight possibility.
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in strongSwan ausnutzen, um einen Denial of Service Angriff durchzuführen.