Denial of Service Vulnerability in strongSwan's gmp Plugin
CVE-2017-9022

7.5HIGH

Key Information:

Vendor

Strongswan

Status
Strongswan
Vendor
CVE Published:
8 June 2017

What is CVE-2017-9022?

The gmp plugin in strongSwan before version 5.5.3 has a security flaw that fails to validate RSA public keys properly when invoking mpz_powm_sec. This oversight allows adversaries to exploit the vulnerability by using specially crafted certificates, which can trigger a floating-point exception and lead to process crashes. As a result, affected systems are susceptible to remote disruptions, compromising their uptime and reliability.

References

https://www.strongswan.org/blog/2017/05/30/strongswan-vul...
x_refsource_CONFIRM
http://www.debian.org/security/2017/dsa-3866
vendor-advisoryx_refsource_DEBIAN
http://www.securityfocus.com/bid/98760
vdb-entryx_refsource_BID

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.