CVE-2013-2944
strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification,...
strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as other users via an invalid signature.
Exploit likelihood
What each source reports
NVD Score used
strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as other users via an invalid signature.
- Record
CVE-2013-2944- CVSS 2.0
- 4.9 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as other users via an invalid signature.
- Record
CVE-2013-2944- Updated
- 2026-11-02
EUVDEUVD-2013-2883 No score
strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as other users via an invalid signature.
- Record
EUVD-2013-2883- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m484-f74p-8pvx No score
strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification,...
strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as other users via an invalid signature.
- Record
GHSA-m484-f74p-8pvx- Weakness
- CWE-287
- Updated
- 2026-11-02
OSV No score
strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as other users via an invalid signature.
- Record
CVE-2013-2944- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-2944 No score
strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as other users via an invalid signature.
- Record
DEBIAN-CVE-2013-2944- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10579-1 No score
strongswan-5.3.5-1.1 on GA media
These are all security issues fixed in the strongswan-5.3.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10579-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1227-1 No score
Security update for strongswan
This update fixes a NULL ptr dereference (DoS) via ID_DER_ASN1_DN ID payloads.
Security Issue reference:
* CVE-2014-2891
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2891>
- Record
SUSE-SU-2015:1227-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-2944 No score
strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as other users via an invalid signature.
- Record
UBUNTU-CVE-2013-2944- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
strongswanDebian:12 |
before 4.6.4-7 | 4.6.4-7 |
strongswanDebian:13 |
before 4.6.4-7 | 4.6.4-7 |
strongswanDebian:14 |
before 4.6.4-7 | 4.6.4-7 |
strongswanDebian:6.0 |
before 4.4.1-5.3, plus listed versions 4.4.1-5.14.4.1-5.2 |
4.4.1-5.3 |
strongswanDebian:7 |
before 4.5.2-1.5+deb7u1 | 4.5.2-1.5+deb7u1 |
strongswanopenSUSE:Tumbleweed From an advisory covering 11 CVEs |
before 5.3.5-1.1 | 5.3.5-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2944 is a medium vulnerability (CVSS 4.9) in Strongswan, published April 30, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.59%, the 75th percentile. Fixed in strongswan 4.6.4-7.
References
strongswan.org/blog/2013/04/30/strongswan-5.0.4-released-%28cve-2013-2944%29.html
lists.opensuse.org/opensuse-updates/2013-06/msg00121.html
debian.org/security/2013/dsa-2665
securityfocus.com/bid/59580
Show 27 moreShow less
download.strongswan.org/patches/10_openssl_ecdsa_signature_patch/strongswan-4.3.5-5.0.3_openssl_ecdsa_signature.patch
nvd.nist.gov/vuln/detail/CVE-2013-2944
github.com/advisories/GHSA-m484-f74p-8pvx
security-tracker.debian.org/tracker/CVE-2013-2944
suse.com/support/update/announcement/2015/suse-su-20151227-1
bugzilla.suse.com/815236
ubuntu.com/security/CVE-2013-2944
cve.org/CVERecord?id=CVE-2013-2944