Every CVE Search/ Get API key

CVE-2015-4171

strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP...

2.6 LowFix available

strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.

Exploit likelihood

2.03%Up 0.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 2.6

strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.

Record
CVE-2015-4171
CVSS 2.0
2.6 LowAV:N/AC:H/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.

Record
CVE-2015-4171
Updated
2026-11-02
EUVDEUVD-2015-4194 No score

strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.

Record
EUVD-2015-4194
Updated
2026-11-03
GitHub AdvisoriesGHSA-mg6m-fcfp-8xqm No score

strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP...

strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.

Record
GHSA-mg6m-fcfp-8xqm
Weakness
CWE-200
Updated
2026-11-02
OSV No score

strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.

Record
CVE-2015-4171
Updated
2026-11-02
OSVDEBIAN-CVE-2015-4171 No score

strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.

Record
DEBIAN-CVE-2015-4171
Updated
2026-11-02
Show 6 moreShow less
OSVopenSUSE-SU-2024:10579-1 No score

strongswan-5.3.5-1.1 on GA media

These are all security issues fixed in the strongswan-5.3.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10579-1
Updated
2026-11-02
OSVSUSE-SU-2015:1196-1 No score

Security update for strongswan

Strongswan was updated to fix one security issue.

The following vulnerability was fixed:

  • CVE-2015-4171: Rogue servers were able to authenticate themselves with certificate issued by any CA the client trusts, to gain user credentials from a client in certain IKEv2 setups (bsc#933591)
Record
SUSE-SU-2015:1196-1
Updated
2026-11-02
OSVSUSE-SU-2015:1227-1 No score

Security update for strongswan

This update fixes a NULL ptr dereference (DoS) via ID_DER_ASN1_DN ID payloads.

Security Issue reference:

* CVE-2014-2891
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2891>
Record
SUSE-SU-2015:1227-1
Updated
2026-11-02
OSVSUSE-SU-2015:1791-1 No score

Security update for strongswan

strongswan was updated to fix one security issue.

This security issue was fixed:

  • CVE-2015-4171: A problem that could enable rogue servers to gain user credentials from a client in certain IKEv2 setups. (bsc#933591)
Record
SUSE-SU-2015:1791-1
Updated
2026-11-02
OSVUBUNTU-CVE-2015-4171 No score

strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.

Record
UBUNTU-CVE-2015-4171
Updated
2026-11-02
OSVUSN-2628-1 No score

strongswan vulnerability

Alexander E. Patrakov discovered that strongSwan incorrectly handled certain IKEv2 setups. A malicious server could possibly use this issue to obtain user credentials.

Record
USN-2628-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
strongswan
Debian:12
 before 5.3.1-1
5.3.1-1
strongswan
Debian:13
 before 5.3.1-1
5.3.1-1
strongswan
Debian:14
 before 5.3.1-1
5.3.1-1
strongswan
Debian:6.0
 before 4.4.1-5.7, plus listed versions
4.4.1-5.14.4.1-5.24.4.1-5.34.4.1-5.44.4.1-5.54.4.1-5.6
4.4.1-5.7
strongswan
Debian:7
 before 4.5.2-1.5+deb7u7, plus listed versions
4.5.2-1.5+deb7u14.5.2-1.5+deb7u24.5.2-1.5+deb7u2~bpo60+14.5.2-1.5+deb7u34.5.2-1.5+deb7u3~bpo60+14.5.2-1.5+deb7u44.5.2-1.5+deb7u6
4.5.2-1.5+deb7u7
strongswan
Debian:8
 before 5.2.1-6+deb8u1, plus listed versions
5.2.1-65.2.1-6+deb8u1~bpo70+1
5.2.1-6+deb8u1
strongswan
SUSE:Linux Enterprise Desktop 12
 before 5.1.3-18.1
5.1.3-18.1
strongswan
SUSE:Linux Enterprise Server 12
 before 5.1.3-18.1
5.1.3-18.1
strongswan
SUSE:Linux Enterprise Server for SAP Applications 12
 before 5.1.3-18.1
5.1.3-18.1
strongswan
SUSE:Linux Enterprise Server 11 SP4
 before 4.4.0-6.29.2
4.4.0-6.29.2
Show 4 moreShow less
Affected packages
PackageAffectedFixed
strongswan
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 4.4.0-6.29.2
4.4.0-6.29.2
strongswan
Ubuntu:14.04:LTS
 before 5.1.2-0ubuntu2.3, plus listed versions
4.6.4-95.1.0-25.1.0-35.1.1-0ubuntu15.1.1-0ubuntu2
Show 14 moreShow less
5.1.1-0ubuntu35.1.1-0ubuntu45.1.1-0ubuntu55.1.1-0ubuntu75.1.1-0ubuntu145.1.1-0ubuntu175.1.2~dr3+git20130120-0ubuntu25.1.2~dr3+git20130120-0ubuntu35.1.2~rc1-0ubuntu35.1.2~rc1-0ubuntu45.1.2~rc2-0ubuntu25.1.2-0ubuntu15.1.2-0ubuntu25.1.2-0ubuntu2.2
5.1.2-0ubuntu2.3
strongswan
Ubuntu:16.04:LTS
 before 5.1.2-0ubuntu6
5.1.2-0ubuntu6
strongswan
openSUSE:Tumbleweed
From an advisory covering 11 CVEs
 before 5.3.5-1.1
5.3.5-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-4171 is a low vulnerability (CVSS 2.6) in Strongswan, published May 14, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.03%, the 81st percentile. Fixed in strongswan 5.3.1-1.

References

Show 35 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open