CVE-2017-9022

High

Published: 08/06/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, allowing remote peers to cause a denial of service (floating point exception and process crash) via a crafted certificate.

Risk Assessment

The organization may experience downtime of VPN services, potentially leading to availability loss and security issues.

Recommendation

It is recommended to update strongSwan to version 5.5.3 or later to mitigate this vulnerability.

Other vulnerabilities in strongSwan gmp plugin

CVE-2017-11185High
The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted RSA signature.

Original NVD description (English source)

The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which allows remote peers to cause a denial of service (floating point exception and process crash) via a crafted certificate.