Improper input validation - CVE-2017-9022

Vulnerability identifier: #VU6873

CSH Severity: Medium

CVSS v4: []

CVE-ID: CVE-2017-9022

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

RSA public keys passed to the gmp plugin in strongSwan aren't validated sufficiently before attempting signature verification, so that invalid input might lead to a floating point exception and crash of the process. A certificate with an appropriately prepared public key sent by a peer could be used for a denial-of-service attack.

Debian Linux
SUSE Linux
Ubuntu
strongswan (Alpine package)

Install update from vendor's website.

strongswan (Alpine package) - update to 5.3.5-r2

• https://www.debian.org/security/2017/dsa-3866

• Debian update for strongswan
• Ubuntu update for strongSwan
• SUSE Linux update for strongswan
• Improper input validation in strongswan (Alpine package)