CVE-2017-9023
HighSummary
The ASN.1 parser in strongSwan before version 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, allowing remote attackers to cause a denial of service (infinite loop) via a crafted certificate.
Risk Assessment
Attackers can exploit this vulnerability to disrupt services, potentially leading to system downtime.
Recommendation
It is recommended to upgrade strongSwan to version 5.5.3 or later to mitigate this vulnerability.
Other vulnerabilities in strongSwan
See all- CVE-2015-3991Critical
strongSwan versions 5.2.2 and 5.3.0 allow remote attackers to cause a denial of service (daemon crash) or execute arbitrary code.
- CVE-2026-47895High
In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.
- CVE-2026-25075High
strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser. Unauthenticated remote attackers can send crafted AVP data with invalid length fields during IKEv2 authentication, causing the charon IKE daemon to crash.
Original NVD description (English source)
The ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allows remote attackers to cause a denial of service (infinite loop) via a crafted certificate.