Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-40617

strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA) certificate that contains a CRL/OCSP URL that points to a server (under the attacker's control) that doesn't properly respond but (for example) just does nothing after the initial TCP handshake, or sends an excessive amount of application data.

Published

2022-10-31T06:15:09.887

Last Modified

2025-05-06T19:15:56.827

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

Weaknesses
  • Type: Primary
    CWE-400
  • Type: Secondary
    CWE-400
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application strongswan strongswan < 5.9.8 Yes
Operating System canonical ubuntu_linux 14.04 Yes
Operating System canonical ubuntu_linux 16.04 Yes
Operating System canonical ubuntu_linux 18.04 Yes
Operating System canonical ubuntu_linux 20.04 Yes
Operating System canonical ubuntu_linux 22.04 Yes
Operating System debian debian_linux 10.0 Yes
Operating System debian debian_linux 11.0 Yes
Operating System fedoraproject fedora 37 Yes
Application stormshield stormshield_network_security < 3.11.20 Yes
Application stormshield stormshield_network_security < 4.3.15 Yes
Application stormshield stormshield_network_security < 4.6.0 Yes
References