Every CVE Search/ Get API key

CVE-2009-2185

The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in ...

5.0 MediumFix available

The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.

Exploit likelihood

2.37%Down 2.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.

Record
CVE-2009-2185
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.

Record
CVE-2009-2185
Updated
2026-11-02
EUVDEUVD-2009-2181 No score

The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.

Record
EUVD-2009-2181
Updated
2026-11-03
GitHub AdvisoriesGHSA-9g49-v8fv-gvm8 No score

The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in ...

The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.

Record
GHSA-9g49-v8fv-gvm8
Weakness
CWE-20
Updated
2026-11-02
OSV No score

The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.

Record
CVE-2009-2185
Updated
2026-11-02
OSVDEBIAN-CVE-2009-2185 No score

The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.

Record
DEBIAN-CVE-2009-2185
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
strongswan
Debian:12
 before 4.2.14-1.2
4.2.14-1.2
strongswan
Debian:13
 before 4.2.14-1.2
4.2.14-1.2
strongswan
Debian:14
 before 4.2.14-1.2
4.2.14-1.2
openswan
Debian:4.0
 before 1:2.4.6+dfsg.2-1.1+etch2, plus listed versions
1:2.4.6+dfsg.2-1.11:2.4.6+dfsg.2-1.1+etch1
1:2.4.6+dfsg.2-1.1+etch2
openswan
Debian:5.0
 before 1:2.4.12+dfsg-1.3+lenny2, plus listed versions
1:2.4.12+dfsg-1.31:2.4.12+dfsg-1.3+lenny1
1:2.4.12+dfsg-1.3+lenny2
strongswan
Debian:4.0
From an advisory covering 4 CVEs
 before 2.8.0+dfsg-1+etch2, plus listed versions
2.8.0+dfsg-12.8.0+dfsg-1+etch1
2.8.0+dfsg-1+etch2
strongswan
Debian:5.0
From an advisory covering 4 CVEs
 before 4.2.4-5+lenny3, plus listed versions
4.2.4-54.2.4-5+lenny14.2.4-5+lenny2
4.2.4-5+lenny3
openswan
Red Hat:enterprise_linux:5::client
 before 0:2.6.14-1.el5_3.3
0:2.6.14-1.el5_3.3
openswan-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:2.6.14-1.el5_3.3
0:2.6.14-1.el5_3.3
openswan-doc
Red Hat:enterprise_linux:5::client
 before 0:2.6.14-1.el5_3.3
0:2.6.14-1.el5_3.3
openswan
Red Hat:enterprise_linux:5::server
 before 0:2.6.14-1.el5_3.3
0:2.6.14-1.el5_3.3
openswan-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:2.6.14-1.el5_3.3
0:2.6.14-1.el5_3.3
openswan-doc
Red Hat:enterprise_linux:5::server
 before 0:2.6.14-1.el5_3.3
0:2.6.14-1.el5_3.3

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-2185 is a medium vulnerability (CVSS 5.0) in Strongswan, published June 24, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.37%, the 83rd percentile. Fixed in strongswan 4.2.14-1.2.

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open