CVE-2021-41991
High
Description
The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries. The code attempts to select a less-often-used cache entry by means of a random number generator, but this is not done correctly. Remote code execution might be a slight possibility.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Strongswan
PublishedOct 18, 2021
First seenOct 18, 2021
How to fix
Update
- strongswan strongswan5.9.4 or later
- siemens scalance_sc646-2c_firmware2.3 or later
Vendor advisories
- debian.org/security/2021/dsa-4989
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5FJSATD2R2XHTG4P63GCMQ2N7EWKMME5/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQSQ3BEC22NF4NCDZVCT4P3Q2ZIAJXGJ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3TQ32JLJOBJDB2EJKSX2PBPB5NFG2D4/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| strongswan strongswan | 4.2.10 ≤ v < 5.9.4 | 5.9.4 |
| debian debian_linux | 9.0, 10.0, 11.0 | — |
| fedoraproject fedora | 33, 34, 35 | — |
| siemens sinema_remote_connect_server | No range specified | — |
| siemens siplus_et_200sp_cp_1542sp-1_irc_tx_rail_firmware | No range specified | — |
| siemens simatic_cp_1243-1_firmware | No range specified | — |
| siemens simatic_cp_1242-7_gprs_v2_firmware | No range specified | — |
| siemens simatic_net_cp_1243-8_irc_firmware | No range specified | — |
| siemens scalance_sc632-2c_firmware | No range specified | — |
| siemens siplus_et_200sp_cp_1543sp-1_isec_firmware | No range specified | — |
| siemens cp_1543-1_firmware | No range specified | — |
| siemens simatic_net_cp_1545-1_firmware | No range specified | — |
| siemens simatic_cp_1543sp-1_firmware | No range specified | — |
| siemens simatic_net_cp1243-7_lte_eu_firmware | No range specified | — |
| siemens simatic_cp_1243-7_lte\/us_firmware | No range specified | — |
| siemens simatic_cp_1542sp-1_firmware | No range specified | — |
| siemens scalance_sc636-2c_firmware | No range specified | — |
| siemens simatic_cp_1542sp-1_irc_firmware | No range specified | — |
| siemens scalance_sc642-2c_firmware | No range specified | — |
| siemens scalance_sc646-2c_firmware | v < 2.3 | 2.3 |
| siemens scalance_sc622-2c_firmware | No range specified | — |
| siemens siplus_s7-1200_cp_1243-1_rail_firmware | No range specified | — |
| siemens siplus_s7-1200_cp_1243-1_firmware | No range specified | — |
| siemens siplus_net_cp_1543-1_firmware | No range specified | — |
| siemens siplus_et_200sp_cp_1543sp-1_isec_tx_rail_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.