This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-41990 →

DEBIAN-CVE-2021-41990

The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. For example, this can...

Original description

The description as published by the source.

The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. For example, this can be triggered by an unrelated self-signed CA certificate sent by an initiator. Remote code execution cannot occur.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 strongswan

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.4-1"}]}]

Debian:13 strongswan

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.4-1"}]}]

Debian:14 strongswan

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.4-1"}]}]

References

advisory security-tracker.debian.org