Back to Database
Status published
High
CVE-2021-41990
The gmp plugin in strongSwan before 5.9.4 has a remote...
Vulnerability Description
The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. For example, this can be triggered by an unrelated self-signed CA certificate sent by an initiator. Remote code execution cannot occur.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-41990
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/strongswan/strongswan/releases/tag/5.9.4
- https://www.strongswan.org/blog/2021/10/18/strongswan-vulnerability-%28cve-2021-41990%29.html
- https://www.debian.org/security/2021/dsa-4989
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5FJSATD2R2XHTG4P63GCMQ2N7EWKMME5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQSQ3BEC22NF4NCDZVCT4P3Q2ZIAJXGJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3TQ32JLJOBJDB2EJKSX2PBPB5NFG2D4/
- https://cert-portal.siemens.com/productcert/pdf/ssa-539476.pdf
More from strongswan
View All →CVE-2022-40617
strongSwan before 5.9.8 allows remote attackers to cause a denial...
Unknown
0
CVE-2021-45079
In strongSwan before 5.9.5, a malicious responder can send an...
Critical
9.1
CVE-2021-41991
The in-memory certificate cache in strongSwan before 5.9.4 has a...
High
7.5
CVE-2018-6459
The rsa_pss_params_parse function in libstrongswan/credentials/keys/signature_params.c in strongSwan 5.6.1 allows remote...
Medium
5.3
CVE-2018-17540
The gmp plugin in strongSwan before 5.7.1 has a Buffer...
High
7.5
Affected Vendor
strongswan
View all reports →Affected Software
strongswan, debian linux, fedora, 6gk6108-4am00-2ba2 firmware, 6gk6108-4am00-2da2 firmware, 6gk5804-0ap00-2aa2 firmware, 6gk5812-1aa00-2aa2 firmware, 6gk5812-1ba00-2aa2 firmware, 6gk5816-1aa00-2aa2 firmware, 6gk5816-1ba00-2aa2 firmware, 6gk5826-2ab00-2ab2 firmware, 6gk5874-2aa00-2aa2 firmware, 6gk5874-3aa00-2aa2 firmware, 6gk5876-3aa02-2ba2 firmware, 6gk5876-3aa02-2ea2 firmware, 6gk5876-4aa00-2ba2 firmware, 6gk5876-4aa00-2da2 firmware, 6gk5856-2ea00-3da1 firmware, 6gk5856-2ea00-3aa1 firmware, 6gk5615-0aa00-2aa2 firmware
Vulnerable Versions:
5.6.1, 10.0, 11.0, 33, 34, 35
Timeline
Official Publish:
October 18th, 2021
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.