CVSS: 7.5EPSS: 8%CPEs: 50EXPL: 0CVE-2021-41991
https://notcve.org/view.php?id=CVE-2021-41991
The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries. The code attempts to select a less-often-used cache entry by means of a random number generator, but this is not done correctly. Remote code execution might be a slight possibility. La caché de certificados en memoria en strongSwan versiones anteriores a 5.9.4, presenta un desbordamiento de enteros remoto al recibir muchas peticiones con diferentes certificados para llenar la caché y posteriormente desencadenar la sustitución de las entradas de la caché. El código intenta seleccionar una entrada de caché menos usada mediante un generador de números aleatorios, pero esto no es realizado correctamente. • https://cert-portal.siemens.com/productcert/pdf/ssa-539476.pdf https://github.com/strongswan/strongswan/releases/tag/5.9.4 https://lists.debian.org/debian-lts-announce/2021/10/msg00014.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5FJSATD2R2XHTG4P63GCMQ2N7EWKMME5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQSQ3BEC22NF4NCDZVCT4P3Q2ZIAJXGJ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mes • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 1%CPEs: 6EXPL: 0CVE-2018-17540
https://notcve.org/view.php?id=CVE-2018-17540
The gmp plugin in strongSwan before 5.7.1 has a Buffer Overflow via a crafted certificate. El plugin gmp en strongSwan en versiones anteriores a la 5.7.1 tiene un desbordamiento de búfer mediante un certificado manipulado. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00077.html http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00047.html https://download.strongswan.org/security/CVE-2018-17540 https://lists.debian.org/debian-lts-announce/2018/10/msg00001.html https://security.gentoo.org/glsa/201811-16 https://usn.ubuntu.com/3774-1 https://www.debian.org/security/2018/dsa-4309 https://www.strongswan • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2018-16151
https://notcve.org/view.php?id=CVE-2018-16151
In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data after the encoded algorithm OID during PKCS#1 v1.5 signature verification. Similar to the flaw in the same version of strongSwan regarding digestAlgorithm.parameters, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication. En verify_emsa_pkcs1_signature() en gmp_rsa_public_key.c en el plugin gmp en strongSwan en versiones 4.x y 5.x anteriores a la 5.7.0, la implementación RSA basada en GMP no rechaza los datos sobrantes tras el algoritmo OID cifrado durante la verificación de firmas PKCS#1 v1.5. De forma similar al error en la misma versión de strongSwan relacionado con digestAlgorithm.parameters, un atacante remoto puede falsificar firmas cuando se emplean pequeños exponentes públicos, lo que podría conducir a una suplantación cuando solo se emplea una firma RSA para la autenticación IKEv2. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00077.html http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00047.html https://lists.debian.org/debian-lts-announce/2018/09/msg00032.html https://security.gentoo.org/glsa/201811-16 https://usn.ubuntu.com/3771-1 https://www.debian.org/security/2018/dsa-4305 https://www.strongswan.org/blog/2018/09/24/strongswan-vulnerability-%28cve-20 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2018-16152
https://notcve.org/view.php?id=CVE-2018-16152
In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication. This is a variant of CVE-2006-4790 and CVE-2014-1568. En verify_emsa_pkcs1_signature() en gmp_rsa_public_key.c en el plugin gmp en strongSwan en versiones 4.x y 5.x anteriores a la 5.7.0, la implementación RSA basada en GMP no rechaza los datos sobrantes en el campo digestAlgorithm.parameters durante la verificación de firmas PKCS#1 v1.5. En consecuencia, un atacante remoto puede falsificar firmas cuando se emplean pequeños exponentes públicos, lo que podría conducir a una suplantación cuando solo se emplea una firma RSA para la autenticación IKEv2. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00077.html http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00047.html https://lists.debian.org/debian-lts-announce/2018/09/msg00032.html https://security.gentoo.org/glsa/201811-16 https://usn.ubuntu.com/3771-1 https://www.debian.org/security/2018/dsa-4305 https://www.strongswan.org/blog/2018/09/24/strongswan-vulnerability-%28cve-20 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 7.5EPSS: 8%CPEs: 7EXPL: 0CVE-2018-10811
https://notcve.org/view.php?id=CVE-2018-10811
strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable. strongSwan, en versiones 5.6.0 y anteriores, permite una denegación de servicio (DoS) remota debido a la falta de inicialización de una variable. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00077.html http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00047.html https://download.strongswan.org/security/CVE-2018-10811 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBO6ZQKLB5RY3TV7MXADFTQKXA2LUEIL https://security.gentoo.org/glsa/201811-16 https://usn.ubuntu.com/3771-1 https://www.debian.org/security& • CWE-909: Missing Initialization of Resource •