CVE-2012-2388
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication...
CVE-2012-2388 is a high vulnerability (CVSS 7.5) in Strongswan, published May 31, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.25%, the 88th percentile. Fixed in strongswan 4.5.2-1.4.
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability."
Exploit likelihood
What each source reports
NVD Score used
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability."
- Record
CVE-2012-2388- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability."
- Record
CVE-2012-2388- Updated
- 2026-11-02
EUVDEUVD-2012-2376 No score
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability."
- Record
EUVD-2012-2376- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4cvm-fc9f-m7w8 No score
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication...
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability."
- Record
GHSA-4cvm-fc9f-m7w8- Weakness
- CWE-287
- Updated
- 2026-11-02
OSV No score
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability."
- Record
CVE-2012-2388- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-2388 No score
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability."
- Record
DEBIAN-CVE-2012-2388- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10579-1 No score
strongswan-5.3.5-1.1 on GA media
These are all security issues fixed in the strongswan-5.3.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10579-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
strongswanDebian:12 |
before 4.5.2-1.4 | 4.5.2-1.4 |
strongswanDebian:13 |
before 4.5.2-1.4 | 4.5.2-1.4 |
strongswanDebian:14 |
before 4.5.2-1.4 | 4.5.2-1.4 |
strongswanDebian:6.0 |
before 4.4.1-5.2, plus listed versions 4.4.1-5.1 |
4.4.1-5.2 |
strongswanopenSUSE:Tumbleweed |
before 5.3.5-1.1 | 5.3.5-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
exchange.xforce.ibmcloud.com/vulnerabilities/76013
securitytracker.com/id?1027110
osvdb.org/82587
secunia.com/advisories/49336
securityfocus.com/bid/53752
Show 19 moreShow less
strongswan.org/blog/2012/05/31/strongswan-4.6.4-released-%28cve-2012-2388%29.html
lists.opensuse.org/opensuse-security-announce/2012-06/msg00002.html
debian.org/security/2012/dsa-2483
nvd.nist.gov/vuln/detail/CVE-2012-2388
github.com/advisories/GHSA-4cvm-fc9f-m7w8
security-tracker.debian.org/tracker/CVE-2012-2388
suse.com/security/cve/CVE-2009-0790