CVE-2021-45079
Critical
Description
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
SeverityCritical
CVSS9.1
Exploit probability—
Product
Strongswan
PublishedJan 31, 2022
First seenJan 31, 2022
How to fix
Update
- strongswan strongswan5.9.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| strongswan strongswan | 4.1.2 ≤ v < 5.9.5 | 5.9.5 |
| debian debian_linux | 9.0, 10.0, 11.0 | — |
| fedoraproject extra_packages_for_enterprise_linux | 7.0, 8.0, 9.0 | — |
| fedoraproject fedora | 34, 35 | — |
| canonical ubuntu_linux | 14.04, 16.04, 18.04, 20.04, 21.10 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.