Strongswan
Monthly
Denial of service via NULL-pointer dereference in strongSwan's x509 plugin affects versions 4.2.0 through 6.0.x, triggered during verification of X.509 attribute certificates. An unauthenticated remote attacker can crash the charon IKE daemon by presenting a crafted attribute certificate during VPN handshake negotiation, taking the gateway offline. Vendor-released fix is strongSwan 6.1.0, published September 7, 2026, as part of a coordinated batch of six CVE patches; no public exploit has been identified at time of analysis.
Use-after-free in strongSwan's IKEv2 Multi-Key Exchange (Multi-KE, RFC 9370) implementation is triggered when two authenticated IKE peers simultaneously initiate a rekey operation, causing a race condition that corrupts heap memory and can result in remote code execution within the IKE daemon. The attack requires an established IKE session and high-complexity timing to induce the collision, reflected in the CVSS AC:H/PR:L vector. Fixed in strongSwan 6.1.0, released September 7, 2026, alongside six other CVEs disclosed in the same advisory batch. No public exploit identified at time of analysis.
Tunneled EAP authentication in strongSwan before 6.1.0 can be bypassed when the IKEv2 responder fails to properly enforce inner EAP method authentication details, enabling a network attacker with a low-privilege outer-tunnel identity to obtain an authorized VPN session without completing the inner credential exchange. The flaw (CWE-863, Incorrect Authorization) is limited to deployments using tunneled EAP methods such as EAP-TTLS or EAP-PEAP; certificate-only or non-tunneled EAP configurations are not affected. Vendor-released patch strongSwan 6.1.0 is available; no public exploit identified at time of analysis.
strongSwan 5.9.7 through versions prior to 6.1.0 lets unauthenticated network attackers drive an IKEv2 responder running charon/libcharon into creating a Child Security Association before the IKE authentication exchange has completed, giving low-level impacts to confidentiality, integrity and availability (CVSS 3.1 base 7.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Reachability over UDP 500/4500 is what drives the score rather than severe impact, and there is a public advisory but no public exploit identified at time of analysis; EPSS is 0.34% (27th percentile), indicating low near-term exploitation likelihood. The vendor-released patch is strongSwan 6.1.0, published alongside a September 2026 batch of unrelated strongSwan fixes (CVE-2026-78123, -78124, -78126, -78127, -78129 through -78131).
Denial of service via infinite loop in strongSwan's x509 plugin affects all deployments that process X.509 attribute certificates. An unauthenticated remote attacker can craft a malformed attribute certificate that triggers CWE-835 (infinite loop) during parsing, causing the IKE daemon to hang indefinitely and disrupting all VPN connectivity. The vendor fixed this in strongSwan 6.1.0 alongside six other vulnerabilities disclosed on 2026-09-07; no public exploit has been identified at time of analysis.
Unauthenticated remote attackers can crash strongSwan versions 4.5.0 through 6.0.4 via integer underflow in the EAP-TTLS AVP parser during IKEv2 authentication by sending malformed AVP packets with invalid length fields. Public exploit code exists for this denial of service vulnerability, which triggers memory corruption in the charon daemon with no available patch. Organizations running affected strongSwan versions are vulnerable to service disruption without authentication or user interaction required.
strongMan's credential encryption uses a static initialization vector with AES-CTR mode, causing all database fields to be encrypted with identical key streams. An attacker with database access can leverage publicly stored certificates to derive the key stream and decrypt stored private keys and EAP secrets. No patch is currently available for this high-severity vulnerability affecting strongSwan management deployments.
Undefined memory access in PKCS#7 container parsing affects an Ubuntu-packaged cryptographic library, potentially enabling denial of service or information disclosure when processing malformed PKCS#7 input. The specific library (OpenSSL, GnuTLS, NSS, or Linux kernel PKCS#7 module) is not identified in available data. No patch version, CVSS score, or CWE classification was provided, leaving severity and exploitability largely unquantified at time of analysis.
Memory leak vulnerabilities in attribute certificate parsing expose affected cryptographic library users to potential denial-of-service via memory exhaustion. Attribute certificates (X.509v2 AC, RFC 5755) are distinct from public-key certificates and carry authorization attributes; parsing them from untrusted network input - for example during TLS handshakes or certificate validation workflows - would allow an unauthenticated remote attacker to trigger repeated leaks and exhaust process heap memory over time. Reported by Ubuntu, no active exploitation has been identified at time of analysis, and no CVSS score is yet assigned.
Unbounded iteration during PKCS#7 container decryption exposes affected systems to a denial-of-service condition where a crafted cryptographic payload causes a parsing loop to run without termination bounds. The specific library or package is not identified in the available intelligence - Ubuntu is the reporting source, suggesting this affects a cryptographic library they distribute (candidates include OpenSSL, GnuTLS, NSS, or similar). An attacker able to supply a malformed PKCS#7 container to a vulnerable parsing routine can exhaust CPU resources and halt service availability. No public exploit has been identified at time of analysis, and no CVSS score or severity rating has been assigned.
Insufficient data exists to characterize this vulnerability beyond its title. The only available intelligence is the description 'Memory Leak During Message Stringification' and a single Ubuntu vendor attribution. No affected product, version, CVSS score, CWE, CPE, references, or patch details have been provided. Memory leak vulnerabilities during message serialization or stringification operations typically result in heap exhaustion and denial of service, but the specific product, component, and exploitation context remain entirely unknown from available data.
NULL-pointer dereference in code handling Authentication and Key Agreement (AKA) Synchronization-Failure messages causes a process crash when a malformed or unexpected AKA-Synchronization-Failure response is processed. The vulnerability affects software that implements 3GPP AKA authentication - a protocol used in mobile network authentication (3G/4G/5G) and EAP-AKA for Wi-Fi/IMS - as packaged by Ubuntu. No public exploit or CISA KEV listing has been identified at time of analysis, and the primary real-world impact is denial of service via crash of the authentication handling daemon.
Memory exhaustion via PKCS#7 certificate processing affects an Ubuntu-packaged cryptographic component, allowing crafted certificate containers to gradually leak heap memory. The vulnerable component is reported by Ubuntu but the specific library (e.g., OpenSSL, GnuTLS, or another ASN.1/PKCS#7 parser) is not identified in available data. An attacker capable of delivering malicious PKCS#7 containers to a vulnerable service - such as a TLS endpoint, S/MIME mail processor, or package verification daemon - could trigger sustained memory growth leading to service degradation or crash.
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA) certificate that contains a CRL/OCSP URL. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable.
The gmp plugin in strongSwan before 5.7.1 has a Buffer Overflow via a crafted certificate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data after the encoded. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In stroke_socket.c in strongSwan before 5.6.3, a missing packet length check could allow a buffer underflow, which may lead to resource exhaustion and denial of service while reading from the socket. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The rsa_pss_params_parse function in libstrongswan/credentials/keys/signature_params.c in strongSwan 5.6.1 allows remote attackers to cause a denial of service via a crafted RSASSA-PSS signature that. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted RSA signature. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allows remote attackers to cause a denial of service (infinite loop) via a crafted. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which allows remote peers to cause a denial of service (floating point exception and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH). Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
strongSwan before 5.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a crafted ID_DER_ASN1_DN ID payload. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IKEv2 in strongSwan 4.0.7 before 5.1.3 allows remote attackers to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) re-authentication, which triggers the IKE_SA state to be set. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
strongSwan 5.0.2 through 5.1.0 allows remote attackers to cause a denial of service (NULL pointer dereference and charon daemon crash) via a crafted IKEv1 fragmentation packet. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
The compare_dn function in utils/identification.c in strongSwan 4.3.3 through 5.1.1 allows (1) remote attackers to cause a denial of service (out-of-bounds read, NULL pointer dereference, and daemon. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
The is_asn1 function in strongSwan 4.1.11 through 5.0.4 does not properly validate the return value of the asn1_length function, which allows remote attackers to cause a denial of service. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Buffer overflow in the atodn function in strongSwan 2.0.0 through 4.3.4, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable. No vendor patch available.
strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as other users via an invalid signature. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability.". Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Denial of service via NULL-pointer dereference in strongSwan's x509 plugin affects versions 4.2.0 through 6.0.x, triggered during verification of X.509 attribute certificates. An unauthenticated remote attacker can crash the charon IKE daemon by presenting a crafted attribute certificate during VPN handshake negotiation, taking the gateway offline. Vendor-released fix is strongSwan 6.1.0, published September 7, 2026, as part of a coordinated batch of six CVE patches; no public exploit has been identified at time of analysis.
Use-after-free in strongSwan's IKEv2 Multi-Key Exchange (Multi-KE, RFC 9370) implementation is triggered when two authenticated IKE peers simultaneously initiate a rekey operation, causing a race condition that corrupts heap memory and can result in remote code execution within the IKE daemon. The attack requires an established IKE session and high-complexity timing to induce the collision, reflected in the CVSS AC:H/PR:L vector. Fixed in strongSwan 6.1.0, released September 7, 2026, alongside six other CVEs disclosed in the same advisory batch. No public exploit identified at time of analysis.
Tunneled EAP authentication in strongSwan before 6.1.0 can be bypassed when the IKEv2 responder fails to properly enforce inner EAP method authentication details, enabling a network attacker with a low-privilege outer-tunnel identity to obtain an authorized VPN session without completing the inner credential exchange. The flaw (CWE-863, Incorrect Authorization) is limited to deployments using tunneled EAP methods such as EAP-TTLS or EAP-PEAP; certificate-only or non-tunneled EAP configurations are not affected. Vendor-released patch strongSwan 6.1.0 is available; no public exploit identified at time of analysis.
strongSwan 5.9.7 through versions prior to 6.1.0 lets unauthenticated network attackers drive an IKEv2 responder running charon/libcharon into creating a Child Security Association before the IKE authentication exchange has completed, giving low-level impacts to confidentiality, integrity and availability (CVSS 3.1 base 7.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Reachability over UDP 500/4500 is what drives the score rather than severe impact, and there is a public advisory but no public exploit identified at time of analysis; EPSS is 0.34% (27th percentile), indicating low near-term exploitation likelihood. The vendor-released patch is strongSwan 6.1.0, published alongside a September 2026 batch of unrelated strongSwan fixes (CVE-2026-78123, -78124, -78126, -78127, -78129 through -78131).
Denial of service via infinite loop in strongSwan's x509 plugin affects all deployments that process X.509 attribute certificates. An unauthenticated remote attacker can craft a malformed attribute certificate that triggers CWE-835 (infinite loop) during parsing, causing the IKE daemon to hang indefinitely and disrupting all VPN connectivity. The vendor fixed this in strongSwan 6.1.0 alongside six other vulnerabilities disclosed on 2026-09-07; no public exploit has been identified at time of analysis.
Unauthenticated remote attackers can crash strongSwan versions 4.5.0 through 6.0.4 via integer underflow in the EAP-TTLS AVP parser during IKEv2 authentication by sending malformed AVP packets with invalid length fields. Public exploit code exists for this denial of service vulnerability, which triggers memory corruption in the charon daemon with no available patch. Organizations running affected strongSwan versions are vulnerable to service disruption without authentication or user interaction required.
strongMan's credential encryption uses a static initialization vector with AES-CTR mode, causing all database fields to be encrypted with identical key streams. An attacker with database access can leverage publicly stored certificates to derive the key stream and decrypt stored private keys and EAP secrets. No patch is currently available for this high-severity vulnerability affecting strongSwan management deployments.
Undefined memory access in PKCS#7 container parsing affects an Ubuntu-packaged cryptographic library, potentially enabling denial of service or information disclosure when processing malformed PKCS#7 input. The specific library (OpenSSL, GnuTLS, NSS, or Linux kernel PKCS#7 module) is not identified in available data. No patch version, CVSS score, or CWE classification was provided, leaving severity and exploitability largely unquantified at time of analysis.
Memory leak vulnerabilities in attribute certificate parsing expose affected cryptographic library users to potential denial-of-service via memory exhaustion. Attribute certificates (X.509v2 AC, RFC 5755) are distinct from public-key certificates and carry authorization attributes; parsing them from untrusted network input - for example during TLS handshakes or certificate validation workflows - would allow an unauthenticated remote attacker to trigger repeated leaks and exhaust process heap memory over time. Reported by Ubuntu, no active exploitation has been identified at time of analysis, and no CVSS score is yet assigned.
Unbounded iteration during PKCS#7 container decryption exposes affected systems to a denial-of-service condition where a crafted cryptographic payload causes a parsing loop to run without termination bounds. The specific library or package is not identified in the available intelligence - Ubuntu is the reporting source, suggesting this affects a cryptographic library they distribute (candidates include OpenSSL, GnuTLS, NSS, or similar). An attacker able to supply a malformed PKCS#7 container to a vulnerable parsing routine can exhaust CPU resources and halt service availability. No public exploit has been identified at time of analysis, and no CVSS score or severity rating has been assigned.
Insufficient data exists to characterize this vulnerability beyond its title. The only available intelligence is the description 'Memory Leak During Message Stringification' and a single Ubuntu vendor attribution. No affected product, version, CVSS score, CWE, CPE, references, or patch details have been provided. Memory leak vulnerabilities during message serialization or stringification operations typically result in heap exhaustion and denial of service, but the specific product, component, and exploitation context remain entirely unknown from available data.
NULL-pointer dereference in code handling Authentication and Key Agreement (AKA) Synchronization-Failure messages causes a process crash when a malformed or unexpected AKA-Synchronization-Failure response is processed. The vulnerability affects software that implements 3GPP AKA authentication - a protocol used in mobile network authentication (3G/4G/5G) and EAP-AKA for Wi-Fi/IMS - as packaged by Ubuntu. No public exploit or CISA KEV listing has been identified at time of analysis, and the primary real-world impact is denial of service via crash of the authentication handling daemon.
Memory exhaustion via PKCS#7 certificate processing affects an Ubuntu-packaged cryptographic component, allowing crafted certificate containers to gradually leak heap memory. The vulnerable component is reported by Ubuntu but the specific library (e.g., OpenSSL, GnuTLS, or another ASN.1/PKCS#7 parser) is not identified in available data. An attacker capable of delivering malicious PKCS#7 containers to a vulnerable service - such as a TLS endpoint, S/MIME mail processor, or package verification daemon - could trigger sustained memory growth leading to service degradation or crash.
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA) certificate that contains a CRL/OCSP URL. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable.
The gmp plugin in strongSwan before 5.7.1 has a Buffer Overflow via a crafted certificate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data after the encoded. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In stroke_socket.c in strongSwan before 5.6.3, a missing packet length check could allow a buffer underflow, which may lead to resource exhaustion and denial of service while reading from the socket. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The rsa_pss_params_parse function in libstrongswan/credentials/keys/signature_params.c in strongSwan 5.6.1 allows remote attackers to cause a denial of service via a crafted RSASSA-PSS signature that. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted RSA signature. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allows remote attackers to cause a denial of service (infinite loop) via a crafted. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which allows remote peers to cause a denial of service (floating point exception and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH). Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
strongSwan before 5.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a crafted ID_DER_ASN1_DN ID payload. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IKEv2 in strongSwan 4.0.7 before 5.1.3 allows remote attackers to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) re-authentication, which triggers the IKE_SA state to be set. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
strongSwan 5.0.2 through 5.1.0 allows remote attackers to cause a denial of service (NULL pointer dereference and charon daemon crash) via a crafted IKEv1 fragmentation packet. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
The compare_dn function in utils/identification.c in strongSwan 4.3.3 through 5.1.1 allows (1) remote attackers to cause a denial of service (out-of-bounds read, NULL pointer dereference, and daemon. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
The is_asn1 function in strongSwan 4.1.11 through 5.0.4 does not properly validate the return value of the asn1_length function, which allows remote attackers to cause a denial of service. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Buffer overflow in the atodn function in strongSwan 2.0.0 through 4.3.4, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable. No vendor patch available.
strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as other users via an invalid signature. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability.". Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.