Summary
Lahav Schlesinger discovered that strongSwan incorrectly handled certain OCSP URIs and
and CRL distribution points (CDP) in certificates. A remote attacker could
possibly use this issue to initiate IKE_SAs and send crafted certificates
that contain URIs pointing to servers under their control, which can lead
to a denial-of-service attack.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | strongswan | 5.6.2-1ubuntu2.9 |
| Ubuntu · 20.04 LTS 20.04:LTS | strongswan | 5.8.2-1ubuntu3.5 |
| Ubuntu · 22.04 LTS 22.04:LTS | strongswan | 5.9.5-2ubuntu2.1 |
Vulnerabilities 1
-
High 7.5
strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a craf…
References
-
report
https://ubuntu.com/security/CVE-2022-40617