CVSS: 9.1EPSS: 1%CPEs: 39EXPL: 0CVE-2015-4171 – Debian Security Advisory 3282-1
https://notcve.org/view.php?id=CVE-2015-4171
10 Jun 2015 — strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses. strongSwan 4.3.0 hasta 5.x anterior a 5.3.2 y strongSwan VPN Client anterior a 1.4.6, cuando utiliza claves EAP o precompartidas para la aut... • http://lists.opensuse.org/opensuse-updates/2015-06/msg00040.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 7%CPEs: 25EXPL: 0CVE-2014-9221 – Ubuntu Security Notice USN-2450-1
https://notcve.org/view.php?id=CVE-2014-9221
05 Jan 2015 — strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025. strongSwan 4.5.x hasta 5.2.x anterior a 5.2.1 permite a atacantes remotos causar una denegación de servicio (referencia a puntero inválido) a través de un mensaje IKEv2 Key Exchange (KE) manipulado con el grupo Diffie-Hellman (DH) 1025. Mike Daskalakis discovered that strongSwan incorrectly handled IK... • http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153825.html • CWE-19: Data Processing Errors •
CVSS: 7.5EPSS: 1%CPEs: 8EXPL: 0CVE-2014-2891 – Debian Security Advisory 2922-1
https://notcve.org/view.php?id=CVE-2014-2891
06 May 2014 — strongSwan before 5.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a crafted ID_DER_ASN1_DN ID payload. strongSwan en versiones anteriores a 5.1.2 permite a atacantes remotos provocar una denegación de servicio (referencia a puntero null y una caída del demonio IKE) a través de un payload IDER_ASN1_DN ID manipulado. Two vulnerabilities have been found in strongSwan, possibly resulting in Denial of Service or a bypass in authentication restriction... • http://lists.opensuse.org/opensuse-updates/2014-05/msg00064.html •