CVE-2021-45079
31.01.2022, 08:15
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| strongswan | strongswan | 4.1.2 ≤ 𝑥 < 5.9.5 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| debian | debian_linux | 11.0 |
| fedoraproject | extra_packages_for_enterprise_linux | 7.0 |
| fedoraproject | extra_packages_for_enterprise_linux | 8.0 |
| fedoraproject | extra_packages_for_enterprise_linux | 9.0 |
| canonical | ubuntu_linux | 14.04 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 20.04 |
| canonical | ubuntu_linux | 21.10 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| strongswan |
|
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| strongswan |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| strongswan-doc |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| strongswan-hmac |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| strongswan-ipsec |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| strongswan-libs0 |
|
Common Weakness Enumeration