Every CVESearch/Get API key

CVE-2014-9221

strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service ...

5.0 MediumFix available

CVE-2014-9221 is a medium vulnerability (CVSS 5.0) in Strongswan, published December 19, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.82%, the 90th percentile. Fixed in strongswan 5.2.1-5.

What does this mean?
Severity
5.0 MediumCVSS 2.0, NVD
Exploit chance
3.82%EPSS, 90th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
5.2.1-5strongswan +8 more

Description

strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.

Exploit likelihood

3.82%Up 1.7 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
strongswan
Debian:12
before 5.2.1-5
5.2.1-5
strongswan
Debian:13
before 5.2.1-5
5.2.1-5
strongswan
Debian:14
before 5.2.1-5
5.2.1-5
strongswan
Debian:7
before 4.5.2-1.5+deb7u6, plus listed versions
4.5.2-1.5+deb7u14.5.2-1.5+deb7u24.5.2-1.5+deb7u2~bpo60+14.5.2-1.5+deb7u34.5.2-1.5+deb7u3~bpo60+14.5.2-1.5+deb7u4
4.5.2-1.5+deb7u6
strongswan
SUSE:Linux Enterprise Desktop 12
before 5.1.3-9.1
5.1.3-9.1
strongswan
SUSE:Linux Enterprise Server 12
before 5.1.3-9.2
5.1.3-9.2
strongswan
SUSE:Linux Enterprise Server for SAP Applications 12
before 5.1.3-9.2
5.1.3-9.2
strongswan
Ubuntu:14.04:LTS
before 5.1.2-0ubuntu2.2, plus listed versions
4.6.4-95.1.0-25.1.0-35.1.1-0ubuntu15.1.1-0ubuntu2
Show 13 moreShow less
5.1.1-0ubuntu35.1.1-0ubuntu45.1.1-0ubuntu55.1.1-0ubuntu75.1.1-0ubuntu145.1.1-0ubuntu175.1.2~dr3+git20130120-0ubuntu25.1.2~dr3+git20130120-0ubuntu35.1.2~rc1-0ubuntu35.1.2~rc1-0ubuntu45.1.2~rc2-0ubuntu25.1.2-0ubuntu15.1.2-0ubuntu2
5.1.2-0ubuntu2.2
strongswan
openSUSE:Tumbleweed
From an advisory covering 11 CVEs
before 5.3.5-1.1
5.3.5-1.1

What each source reports

NVD Score used5.0

strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.

Record
CVE-2014-9221
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-19
Updated
2026-11-02
CVE ListNo score

strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.

Record
CVE-2014-9221
Updated
2026-11-02
EUVDEUVD-2014-9046No score

strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.

Record
EUVD-2014-9046
Updated
2026-11-03
GitHub AdvisoriesGHSA-r7v4-h67j-q6qxNo score

strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service ...

strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.

Record
GHSA-r7v4-h67j-q6qx
Updated
2026-11-02
OSVNo score

strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.

Record
CVE-2014-9221
Updated
2026-11-02
OSVDEBIAN-CVE-2014-9221No score

strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.

Record
DEBIAN-CVE-2014-9221
Updated
2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2024:10579-1No score

strongswan-5.3.5-1.1 on GA media

These are all security issues fixed in the strongswan-5.3.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10579-1
Updated
2026-11-02
OSVSUSE-SU-2015:0281-1No score

Security update for strongswan

This strongswan update fixes the following security and non security issues.

  • Disallow brainpool elliptic curve groups in fips mode (bnc#856322).
  • Applied an upstream fix for a denial-of-service vulnerability, which can be triggered by an IKEv2 Key Exchange payload, that contains the Diffie-Hellman group 1025 (bsc#910491,CVE-2014-9221).
  • Adjusted whilelist of approved algorithms in fips mode (bsc#856322).
  • Updated strongswan-hmac package description (bsc#856322).
  • Disabled explicit gpg validation; osc source_validator does it.
  • Guarded fipscheck and hmac package in the spec file for >13.1.
  • Added generation of fips hmac hash files using fipshmac utility and a _fipscheck script to verify binaries/libraries/plugings shipped in the strongswan-hmac package. With enabled fips in the kernel, the ipsec script will call it before any action or in a enforced/manual 'ipsec _fipscheck' call. Added config file to load openssl and kernel af-alg plugins, but not all the other modules which provide further/alternative algs. Applied a filter disallowing non-approved algorithms in fips mode. (fate#316931,bnc#856322).
  • Fixed file list in the optional (disabled) strongswan-test package.
  • Fixed build of the strongswan built-in integrity checksum library and enabled building it only on architectures tested to work.
  • Fix to use bug number 897048 instead 856322 in last changes entry.
  • Applied an upstream patch reverting to store algorithms in the registration order again as ordering them by identifier caused weaker algorithms to be proposed first by default (bsc#897512).
Record
SUSE-SU-2015:0281-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-9221No score

strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.

Record
UBUNTU-CVE-2014-9221
Updated
2026-11-02
OSVUSN-2450-1No score

strongswan vulnerability

Mike Daskalakis discovered that strongSwan incorrectly handled IKEv2 payloads that contained the Diffie-Hellman group 1025. A remote attacker could use this issue to cause the IKE daemon to crash, resulting in a denial of service.

Record
USN-2450-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 28 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open