[Bugs] [Bug 13320] New: [CVE 21] strongswan 5.9.1 CVEs found

[bugzilla]

https://bugzilla.rosalinux.ru/show_bug.cgi?id=13320

          Platform: 2021.1
            Bug ID: 13320
           Summary: [CVE 21] strongswan 5.9.1  CVEs found
    Classification: ROSA-based products
           Product: ROSA Fresh
           Version: All
          Hardware: All
               URL: CVE-2021-41990, CVE-2021-41991, CVE-2021-45079,
                    CVE-2022-40617,
                OS: Linux
            Status: CONFIRMED
          Severity: normal
          Priority: Normal
         Component: System (kernel, glibc, systemd, bash, PAM...)
          Assignee: bugs на lists.rosalinux.ru
          Reporter: y.tumanov на rosalinux.ru
        QA Contact: bugs на lists.rosalinux.ru
                CC: s.matveev на rosalinux.ru, y.tumanov на rosalinux.ru
  Target Milestone: ---
             Flags: secteam_verified?

Please patch CVEs for package strongswan version 5.9.1

INFO (CVEs are): strongswan 5.9.1
 cves found
CVE-2021-41990
Desc: The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow
via a crafted certificate with an RSASSA-PSS signature. For example, this can
be triggered by an unrelated self-signed CA certificate sent by an initiator.
Remote code execution cannot occur.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-41990
Severity: HIGH
CVE-2021-41991
Desc: The in-memory certificate cache in strongSwan before 5.9.4 has a remote
integer overflow upon receiving many requests with different certificates to
fill the cache and later trigger the replacement of cache entries. The code
attempts to select a less-often-used cache entry by means of a random number
generator, but this is not done correctly. Remote code execution might be a
slight possibility.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-41991
Severity: HIGH
CVE-2021-45079
Desc: In strongSwan before 5.9.5, a malicious responder can send an EAP-Success
message too early without actually authenticating the client and (in the case
of EAP methods with mutual authentication and EAP-only authentication for
IKEv2) even without server authentication.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-45079
Severity: CRITICAL
CVE-2022-40617
Desc: strongSwan before 5.9.8 allows remote attackers to cause a denial of
service in the revocation plugin by sending a crafted end-entity (and
intermediate CA) certificate that contains a CRL/OCSP URL that points to a
server (under the attacker's control) that doesn't properly respond but (for
example) just does nothing after the initial TCP handshake, or sends an
excessive amount of application data.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-40617
Severity: HIGH

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
----------- следущая часть -----------
Вложение в формате HTML было извлечено…
URL: <http://lists.rosalinux.ru/pipermail/bugs/attachments/20230503/5db59d83/attachment.html>