CVE-2021-45079
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early...
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
- Record
CVE-2021-45079- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
- Record
CVE-2021-45079- Updated
- 2026-11-02
EUVDEUVD-2021-31872 No score
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
- Record
EUVD-2021-31872- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8x8f-8g3r-h75g
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early...
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
- Record
GHSA-8x8f-8g3r-h75g- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-45079
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
- Record
ALPINE-CVE-2021-45079- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVAZL-8473
CVE-2021-45079 affecting package strongswan for versions less than 5.9.5-1
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
- Record
AZL-8473- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
Show 13 moreShow less
OSV
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
- Record
CVE-2021-45079- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-45079
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
- Record
DEBIAN-CVE-2021-45079- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2022-1525
strongswan security update
The strongSwan IPsec implementation supports both the IKEv1 and IKEv2 key exchange protocols in conjunction with the native NETKEY IPsec stack of the Linux kernel.
Security Fix(es):
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.(CVE-2021-45079)
- Record
OESA-2022-1525- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2022-2068
strongswan security update
The strongSwan IPsec implementation supports both the IKEv1 and IKEv2 key exchange protocols in conjunction with the native NETKEY IPsec stack of the Linux kernel.
Security Fix(es):
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.(CVE-2021-45079)
- Record
OESA-2022-2068- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-45079
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
- Record
UBUNTU-CVE-2021-45079- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2022:0492-1 No score
Security update for strongswan
This update for strongswan fixes the following issues:
- CVE-2021-45079: Fixed authentication bypass in EAP authentication. (bsc#1194471)
- Record
openSUSE-SU-2022:0492-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11808-1 No score
strongswan-5.9.5-1.1 on GA media
These are all security issues fixed in the strongswan-5.9.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11808-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:0202-1 No score
Security update for strongswan
This update for strongswan fixes the following issues:
- CVE-2021-45079: Fixed authentication bypass in EAP authentication. (bsc#1194471)
- Record
SUSE-SU-2022:0202-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:0211-1 No score
Security update for strongswan
This update for strongswan fixes the following issues:
- CVE-2021-45079: Fixed authentication bypass in EAP authentication. (bsc#1194471)
- Record
SUSE-SU-2022:0211-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:0492-1 No score
Security update for strongswan
This update for strongswan fixes the following issues:
- CVE-2021-45079: Fixed authentication bypass in EAP authentication. (bsc#1194471)
- Record
SUSE-SU-2022:0492-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:14887-1 No score
Security update for strongswan
This update for strongswan fixes the following issues:
- CVE-2018-16151: Fixed flaws in gmp plugin that could lead to authorization bypass. (bsc#1107874)
- CVE-2018-16152: Fixed flaws in gmp plugin that could lead to authorization bypass. (bsc#1107874)
- CVE-2018-17540: Fixed insufficient input validation in gmp plugin. (bsc#1109845)
- CVE-2021-45079: Fixed authentication bypass in EAP authentication. (bsc#1194471)
- Record
SUSE-SU-2022:14887-1- Updated
- 2026-11-02
OSVUSN-5250-1 No score
strongswan vulnerability
Zhuowei Zhang discovered that stringSwan incorrectly handled EAP authentication. A remote attacker could use this issue to cause strongSwan to crash, resulting in a denial of service, or possibly bypass client and server authentication.
- Record
USN-5250-1- Updated
- 2026-11-02
OSVUSN-5250-2 No score
strongswan vulnerability
USN-5250-1 fixed a vulnerability in strongSwan. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
Zhuowei Zhang discovered that stringSwan incorrectly handled EAP authentication. A remote attacker could use this issue to cause strongSwan to crash, resulting in a denial of service, or possibly bypass client and server authentication.
- Record
USN-5250-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
strongswanAlpine:v3.13 |
4.1.2 up to 5.9.1-r2 | 5.9.1-r2 |
strongswanAlpine:v3.14 |
4.1.2 up to 5.9.1-r3 | 5.9.1-r3 |
strongswanAlpine:v3.15 |
4.1.2 up to 5.9.1-r4 | 5.9.1-r4 |
strongswanAlpine:v3.16 |
4.1.2 up to 5.9.1-r4 | 5.9.1-r4 |
strongswanAlpine:v3.17 |
4.1.2 up to 5.9.1-r4 | 5.9.1-r4 |
strongswanAlpine:v3.18 |
4.1.2 up to 5.9.1-r4 | 5.9.1-r4 |
strongswanAlpine:v3.19 |
4.1.2 up to 5.9.1-r4 | 5.9.1-r4 |
strongswanAlpine:v3.20 |
4.1.2 up to 5.9.1-r4 | 5.9.1-r4 |
strongswanAlpine:v3.21 |
4.1.2 up to 5.9.1-r4 | 5.9.1-r4 |
strongswanAlpine:v3.22 |
4.1.2 up to 5.9.1-r4 | 5.9.1-r4 |
Show 64 moreShow less
| Package | Affected | Fixed |
|---|---|---|
strongswanAlpine:v3.23 |
4.1.2 up to 5.9.1-r4 | 5.9.1-r4 |
strongswanAlpine:v3.24 |
4.1.2 up to 5.9.1-r4 | 5.9.1-r4 |
strongswanAzure Linux:2 |
before 5.9.5-1 | 5.9.5-1 |
strongswanDebian:12 |
before 5.9.5-1 | 5.9.5-1 |
strongswanDebian:13 |
before 5.9.5-1 | 5.9.5-1 |
strongswanDebian:14 |
before 5.9.5-1 | 5.9.5-1 |
strongswanDebian:9 |
before 5.5.1-4+deb9u6, plus listed versions 5.5.1-45.5.1-4+deb9u15.5.1-4+deb9u25.5.1-4+deb9u35.5.1-4+deb9u45.5.1-4+deb9u5 |
5.5.1-4+deb9u6 |
strongswanDebian:10 |
before 5.7.2-1+deb10u2, plus listed versions 5.7.2-15.7.2-1+deb10u1 |
5.7.2-1+deb10u2 |
strongswanDebian:11 |
before 5.9.1-1+deb11u2, plus listed versions 5.9.1-15.9.1-1+deb11u1 |
5.9.1-1+deb11u2 |
strongswanopenEuler:20.03-LTS-SP1 |
before 5.7.2-8.oe1 | 5.7.2-8.oe1 |
strongswanopenEuler:20.03-LTS-SP2 |
before 5.7.2-8.oe1 | 5.7.2-8.oe1 |
strongswanopenEuler:20.03-LTS-SP3 |
before 5.7.2-9.oe1 | 5.7.2-9.oe1 |
strongswanopenEuler:22.03-LTS |
before 5.7.2-12.oe2203 | 5.7.2-12.oe2203 |
strongswanSUSE:HPE Helion OpenStack 8 |
before 5.1.3-26.20.1 | 5.1.3-26.20.1 |
strongswanSUSE:OpenStack Cloud 8 |
before 5.1.3-26.20.1 | 5.1.3-26.20.1 |
strongswanSUSE:OpenStack Cloud 9 |
before 5.1.3-26.20.1 | 5.1.3-26.20.1 |
strongswanSUSE:OpenStack Cloud Crowbar 8 |
before 5.1.3-26.20.1 | 5.1.3-26.20.1 |
strongswanSUSE:OpenStack Cloud Crowbar 9 |
before 5.1.3-26.20.1 | 5.1.3-26.20.1 |
strongswanSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 5.1.3-26.20.1 | 5.1.3-26.20.1 |
strongswanSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 5.1.3-26.20.1 | 5.1.3-26.20.1 |
strongswanSUSE:Linux Enterprise Server 12 SP2-BCL |
before 5.1.3-26.20.1 | 5.1.3-26.20.1 |
strongswanSUSE:Linux Enterprise Server 12 SP3-LTSS |
before 5.1.3-26.20.1 | 5.1.3-26.20.1 |
strongswanSUSE:Linux Enterprise Server 12 SP3-BCL |
before 5.1.3-26.20.1 | 5.1.3-26.20.1 |
strongswanSUSE:Linux Enterprise Server 12 SP4-LTSS |
before 5.1.3-26.20.1 | 5.1.3-26.20.1 |
strongswanSUSE:Linux Enterprise Server 12 SP5 |
before 5.1.3-26.20.1 | 5.1.3-26.20.1 |
strongswanSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 5.1.3-26.20.1 | 5.1.3-26.20.1 |
strongswanSUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 5.8.2-4.17.1 | 5.8.2-4.17.1 |
strongswanSUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 5.8.2-4.17.1 | 5.8.2-4.17.1 |
strongswanSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS |
before 5.8.2-4.17.1 | 5.8.2-4.17.1 |
strongswanSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS |
before 5.8.2-4.17.1 | 5.8.2-4.17.1 |
strongswanSUSE:Linux Enterprise Server 15-LTSS |
before 5.8.2-4.17.1 | 5.8.2-4.17.1 |
strongswanSUSE:Linux Enterprise Server 15 SP1-BCL |
before 5.8.2-4.17.1 | 5.8.2-4.17.1 |
strongswanSUSE:Linux Enterprise Server 15 SP1-LTSS |
before 5.8.2-4.17.1 | 5.8.2-4.17.1 |
strongswanSUSE:Linux Enterprise Server for SAP Applications 15 |
before 5.8.2-4.17.1 | 5.8.2-4.17.1 |
strongswanSUSE:Linux Enterprise Server for SAP Applications 15 SP1 |
before 5.8.2-4.17.1 | 5.8.2-4.17.1 |
strongswanSUSE:Enterprise Storage 6 |
before 5.8.2-4.17.1 | 5.8.2-4.17.1 |
strongswanSUSE:Linux Enterprise Module for Basesystem 15 SP3 |
before 5.8.2-11.24.1 | 5.8.2-11.24.1 |
strongswanSUSE:Linux Enterprise Module for Package Hub 15 SP3 |
before 5.8.2-11.24.1 | 5.8.2-11.24.1 |
strongswanSUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS |
before 5.8.2-11.24.1 | 5.8.2-11.24.1 |
strongswanSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS |
before 5.8.2-11.24.1 | 5.8.2-11.24.1 |
strongswanSUSE:Linux Enterprise Real Time 15 SP2 |
before 5.8.2-11.24.1 | 5.8.2-11.24.1 |
strongswanSUSE:Linux Enterprise Server 15 SP2-BCL |
before 5.8.2-11.24.1 | 5.8.2-11.24.1 |
strongswanSUSE:Linux Enterprise Server 15 SP2-LTSS |
before 5.8.2-11.24.1 | 5.8.2-11.24.1 |
strongswanSUSE:Linux Enterprise Server for SAP Applications 15 SP2 |
before 5.8.2-11.24.1 | 5.8.2-11.24.1 |
strongswanSUSE:Manager Proxy 4.1 |
before 5.8.2-11.24.1 | 5.8.2-11.24.1 |
strongswanSUSE:Manager Retail Branch Server 4.1 |
before 5.8.2-11.24.1 | 5.8.2-11.24.1 |
strongswanSUSE:Manager Server 4.1 |
before 5.8.2-11.24.1 | 5.8.2-11.24.1 |
strongswanSUSE:Linux Enterprise Workstation Extension 15 SP3 |
before 5.8.2-11.24.1 | 5.8.2-11.24.1 |
strongswanSUSE:Enterprise Storage 7 |
before 5.8.2-11.24.1 | 5.8.2-11.24.1 |
strongswanSUSE:Linux Enterprise Point of Sale 11 SP3 From an advisory covering 4 CVEs |
before 4.4.0-6.36.12.1 | 4.4.0-6.36.12.1 |
strongswanSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 4 CVEs |
before 4.4.0-6.36.12.1 | 4.4.0-6.36.12.1 |
strongswanUbuntu:Pro:14.04:LTS |
before 5.1.2-0ubuntu2.11+esm2, plus listed versions 4.6.4-95.1.0-25.1.0-35.1.1-0ubuntu15.1.1-0ubuntu2 Show 23 moreShow less5.1.1-0ubuntu35.1.1-0ubuntu45.1.1-0ubuntu55.1.1-0ubuntu75.1.1-0ubuntu145.1.1-0ubuntu175.1.2~dr3+git20130120-0ubuntu25.1.2~dr3+git20130120-0ubuntu35.1.2~rc1-0ubuntu35.1.2~rc1-0ubuntu45.1.2~rc2-0ubuntu25.1.2-0ubuntu15.1.2-0ubuntu25.1.2-0ubuntu2.25.1.2-0ubuntu2.35.1.2-0ubuntu2.45.1.2-0ubuntu2.55.1.2-0ubuntu2.65.1.2-0ubuntu2.75.1.2-0ubuntu2.85.1.2-0ubuntu2.105.1.2-0ubuntu2.115.1.2-0ubuntu2.11+esm1 |
5.1.2-0ubuntu2.11+esm2 |
strongswanUbuntu:Pro:16.04:LTS |
before 5.3.5-1ubuntu3.8+esm2, plus listed versions 5.1.2-0ubuntu65.1.2-0ubuntu75.1.2-0ubuntu85.3.5-1ubuntu15.3.5-1ubuntu2 Show 9 moreShow less5.3.5-1ubuntu35.3.5-1ubuntu3.15.3.5-1ubuntu3.25.3.5-1ubuntu3.35.3.5-1ubuntu3.45.3.5-1ubuntu3.55.3.5-1ubuntu3.75.3.5-1ubuntu3.85.3.5-1ubuntu3.8+esm1 |
5.3.5-1ubuntu3.8+esm2 |
strongswanUbuntu:Pro:FIPS-updates:16.04:LTS |
before 5.3.5-1ubuntu3.fips.3.8.3, plus listed versions 5.3.5-1ubuntu3.fips.3.4.15.3.5-1ubuntu3.fips.3.4.25.3.5-1ubuntu3.fips.3.8.15.3.5-1ubuntu3.fips.3.8.2 |
5.3.5-1ubuntu3.fips.3.8.3 |
strongswanUbuntu:Pro:FIPS:16.04:LTS |
All versions, plus listed versions 5.3.5-1ubuntu3.fips.3.15.3.5-1ubuntu3.fips.3.25.3.5-1ubuntu3.fips.3.3 |
None known |
strongswanUbuntu:18.04:LTS |
before 5.6.2-1ubuntu2.8, plus listed versions 5.5.1-4ubuntu25.5.1-4ubuntu35.6.1-2ubuntu15.6.1-2ubuntu25.6.1-2ubuntu3 Show 8 moreShow less5.6.1-2ubuntu45.6.2-1ubuntu25.6.2-1ubuntu2.25.6.2-1ubuntu2.35.6.2-1ubuntu2.45.6.2-1ubuntu2.55.6.2-1ubuntu2.65.6.2-1ubuntu2.7 |
5.6.2-1ubuntu2.8 |
strongswanUbuntu:Pro:FIPS-updates:18.04:LTS |
before 5.6.2-1ubuntu2.fips.2.8.1, plus listed versions 5.6.2-1ubuntu2.fips.2.5.15.6.2-1ubuntu2.fips.2.7.15.6.2-1ubuntu2.fips.2.7.2 |
5.6.2-1ubuntu2.fips.2.8.1 |
strongswanUbuntu:Pro:FIPS:18.04:LTS |
All versions, plus listed versions 5.6.2-1ubuntu2.fips.2.4.25.6.2-1ubuntu2.fips.2.5.1 |
None known |
strongswanUbuntu:20.04:LTS |
before 5.8.2-1ubuntu3.4, plus listed versions 5.7.2-1ubuntu35.8.1-1ubuntu15.8.2-1ubuntu15.8.2-1ubuntu25.8.2-1ubuntu35.8.2-1ubuntu3.15.8.2-1ubuntu3.25.8.2-1ubuntu3.3 |
5.8.2-1ubuntu3.4 |
strongswanUbuntu:Pro:FIPS-updates:20.04:LTS |
before 5.8.2-1ubuntu3.fips.3.4.1, plus listed versions 5.8.2-1ubuntu3.fips.3.1.25.8.2-1ubuntu3.fips.3.3.1 |
5.8.2-1ubuntu3.fips.3.4.1 |
strongswanUbuntu:Pro:FIPS:20.04:LTS |
All versions, plus listed versions 5.8.2-1ubuntu3.fips.3.1.2 |
None known |
strongswanUbuntu:22.04:LTS |
before 5.9.4-1ubuntu4, plus listed versions 5.9.1-1ubuntu35.9.1-1ubuntu3.15.9.4-1ubuntu15.9.4-1ubuntu25.9.4-1ubuntu3 |
5.9.4-1ubuntu4 |
strongswanopenSUSE:Leap 15.3 |
before 5.8.2-11.24.1 | 5.8.2-11.24.1 |
strongswanopenSUSE:Tumbleweed |
before 5.9.5-1.1 | 5.9.5-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-45079 is a critical vulnerability (CVSS 9.1) in Strongswan, published January 24, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.76%, the 86th percentile. Fixed in strongswan 5.9.1-r2.
References
strongswan.org/blog/2022/01/24/strongswan-vulnerability-%28cve-2021-45079%29.html
nvd.nist.gov/vuln/detail/CVE-2021-45079
github.com/advisories/GHSA-8x8f-8g3r-h75g
security.alpinelinux.org/vuln/CVE-2021-45079
security-tracker.debian.org/tracker/CVE-2021-45079
Show 19 moreShow less
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1525
suse.com/support/update/announcement/2022/suse-su-20220202-1
bugzilla.suse.com/1194471
ubuntu.com/security/CVE-2021-45079
cve.org/CVERecord?id=CVE-2021-45079
lists.opensuse.org/archives/list/[email protected]/thread/PDDGV75VWTCAFSBICC2NAFQ3EN5G6NAI