This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-41991 →

UBUNTU-CVE-2021-41991

The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to f...

Original description

The description as published by the source.

The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries. The code attempts to select a less-often-used cache entry by means of a random number generator, but this is not done correctly. Remote code execution might be a slight possibility.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:Pro:14.04:LTS strongswan

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-0ubuntu2.11+esm1"}]}]

Ubuntu:Pro:16.04:LTS strongswan

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.5-1ubuntu3.8+esm1"}]}]

Ubuntu:Pro:FIPS-updates:16.04:LTS strongswan

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.5-1ubuntu3.fips.3.8.2"}]}]

Ubuntu:Pro:FIPS:16.04:LTS strongswan

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:18.04:LTS strongswan

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2-1ubuntu2.7"}]}]

Ubuntu:Pro:FIPS-updates:18.04:LTS strongswan

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2-1ubuntu2.fips.2.7.1"}]}]

Ubuntu:Pro:FIPS:18.04:LTS strongswan

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:20.04:LTS strongswan

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.2-1ubuntu3.3"}]}]

Ubuntu:Pro:FIPS-updates:20.04:LTS strongswan

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.2-1ubuntu3.fips.3.3.1"}]}]

Ubuntu:Pro:FIPS:20.04:LTS strongswan

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:22.04:LTS strongswan

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-1ubuntu3.1"}]}]

References

advisory ubuntu.com
advisory ubuntu.com
report ubuntu.com
report cve.org