CVE-2021-41991

The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries. The code attempts to select a less-often-used cache entry by means of a random number generator, but this is not done correctly. Remote code execution might be a slight possibility.

The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries. The code attempts to select a less-often-used cache entry by means of a random number generator, but this is not done correctly. Remote code execution might be a slight possibility.

The strongSwan IPsec implementation supports both the IKEv1 and IKEv2 key exchange protocols in conjunction with the native NETKEY IPsec stack of the Linux kernel.

Security Fix(es):

The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. For example, this can be triggered by an unrelated self-signed CA certificate sent by an initiator. Remote code execution cannot occur.(CVE-2021-41990)

The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries. The code attempts to select a less-often-used cache entry by means of a random number generator, but this is not done correctly. Remote code execution might be a slight possibility.(CVE-2021-41991)

The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries. The code attempts to select a less-often-used cache entry by means of a random number generator, but this is not done correctly. Remote code execution might be a slight possibility.

This update for strongswan fixes the following issues:

A feature was added:

• Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)

Security issues fixed:

• CVE-2021-41991: Fixed an integer overflow when replacing certificates in cache. (bsc#1191435)
• CVE-2021-41990: Fixed an integer Overflow in the gmp Plugin. (bsc#1191367)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for strongswan fixes the following issues:

A feature was added:

• Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)

Security issues fixed:

• CVE-2021-41991: Fixed an integer overflow when replacing certificates in cache. (bsc#1191435)
• CVE-2021-41990: Fixed an integer Overflow in the gmp Plugin. (bsc#1191367)

These are all security issues fixed in the strongswan-5.9.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for strongswan fixes the following issues:

• CVE-2021-41991: Fixed an integer overflow when replacing certificates in cache. (bsc#1191435)

This update for strongswan fixes the following issues:

A feature was added:

• Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)

Security issues fixed:

• CVE-2021-41991: Fixed an integer overflow when replacing certificates in cache. (bsc#1191435)
• CVE-2021-41990: Fixed an integer Overflow in the gmp Plugin. (bsc#1191367)

This update for strongswan fixes the following issues:

• CVE-2021-41991: Fixed an integer overflow when replacing certificates in cache. (bsc#1191435)

This update for strongswan fixes the following issues:

• Fix trailing quotation mark missing from example in README. (bsc#1167880)
• CVE-2021-41991: Fixed an integer overflow when replacing certificates in cache. (bsc#1191435)
• CVE-2021-41990: Fixed an integer Overflow in the gmp Plugin. (bsc#1191367)

It was discovered that strongSwan incorrectly handled certain RSASSA-PSS signatures. A remote attacker could use this issue to cause strongSwan to crash, resulting in a denial of service. (CVE-2021-41990)

It was discovered that strongSwan incorrectly handled replacing certificates in the cache. A remote attacker could use this issue to cause strongSwan to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-41991)

USN-5111-1 fixed a vulnerability in strongSwan. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that strongSwan incorrectly handled replacing certificates in the cache. A remote attacker could use this issue to cause strongSwan to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-41991)