Description
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | strongswan | 4.3.2-1.1 | — |
| Debian 13 | strongswan | 4.3.2-1.1 | — |
| Debian 12 | strongswan | 4.3.2-1.1 | — |
| Debian 5.0 | strongswan | 4.2.4-5+lenny3 | DSA-1899-1 |
| Debian 4.0 | strongswan | 2.8.0+dfsg-1+etch2 | DSA-1899-1 |
Advisories 1
- DSA-1899-1 strongswan - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20090727 CVE id request: strongswan mailing-list
- http://download.strongswan.org/patches/07_asn1_length_patch/strongswan-4.x.x_asn1_length.patch
- SUSE-SR:2009:018 vendor-advisory
- 36922 third-party-advisory
- DSA-1899 vendor-advisory
- ADV-2009-2247 vdb-entry
- http://up2date.astaro.com/2009/08/up2date_7505_released.html
- SUSE-SR:2009:016 vendor-advisory
- http://download.strongswan.org/patches/07_asn1_length_patch/strongswan-4.3.x_asn1_length.patch
- [Announce] 20090723 ANNOUNCE: strongswan-2.8.11 and strongswan-4.2.17 released mailing-list