CVE-2012-2388
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication...
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability."
Exploit likelihood
What each source reports
NVD Score used
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability."
- Record
CVE-2012-2388- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE ListNo score
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability."
- Record
CVE-2012-2388- Updated
- 2026-11-02
EUVDEUVD-2012-2376No score
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability."
- Record
EUVD-2012-2376- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4cvm-fc9f-m7w8No score
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication...
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability."
- Record
GHSA-4cvm-fc9f-m7w8- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVNo score
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability."
- Record
CVE-2012-2388- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-2388No score
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability."
- Record
DEBIAN-CVE-2012-2388- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10579-1No score
strongswan-5.3.5-1.1 on GA media
These are all security issues fixed in the strongswan-5.3.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10579-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
strongswanDebian:12 | before 4.5.2-1.4 | 4.5.2-1.4 |
strongswanDebian:13 | before 4.5.2-1.4 | 4.5.2-1.4 |
strongswanDebian:14 | before 4.5.2-1.4 | 4.5.2-1.4 |
strongswanDebian:6.0 | before 4.4.1-5.2, plus listed versions 4.4.1-5.1 | 4.4.1-5.2 |
strongswanopenSUSE:Tumbleweed From an advisory covering 11 CVEs | before 5.3.5-1.1 | 5.3.5-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-2388 is a high vulnerability (CVSS 7.5) in Strongswan, published May 31, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.25%, the 88th percentile. Fixed in strongswan 4.5.2-1.4.
References
exchange.xforce.ibmcloud.com/vulnerabilities/76013
securitytracker.com/id?1027110
osvdb.org/82587
secunia.com/advisories/49336
securityfocus.com/bid/53752
Show 19 moreShow less
strongswan.org/blog/2012/05/31/strongswan-4.6.4-released-%28cve-2012-2388%29.html
lists.opensuse.org/opensuse-security-announce/2012-06/msg00002.html
debian.org/security/2012/dsa-2483
nvd.nist.gov/vuln/detail/CVE-2012-2388
github.com/advisories/GHSA-4cvm-fc9f-m7w8
security-tracker.debian.org/tracker/CVE-2012-2388
suse.com/security/cve/CVE-2009-0790