| Package | Affected versions | Patched versions |
|---|---|---|
| strongswan | = 2.0.0= 2.0.1= 2.0.2= 2.1.0= 2.1.1= 2.1.2= 2.1.3= 2.1.4= 2.1.5= 2.2.0= 2.2.1= 2.2.2= 2.3.0= 2.3.1= 2.3.2= 2.4.0= 2.4.0a= 2.4.1= 2.4.2= 2.4.3= 2.5.0= 2.5.1= 2.5.2= 2.5.3= 2.5.4= 2.5.5= 2.5.6= 2.5.7= 2.6.0= 2.6.1= 2.6.2= 2.6.3= 2.6.4= 2.7.0= 4.0.0= 4.0.1= 4.0.2= 4.0.3= 4.0.4= 4.0.5= 4.0.6= 4.0.7= 4.1.0= 4.1.1= 4.1.10= 4.1.11= 4.1.2= 4.1.3= 4.1.4= 4.1.5= 4.1.6= 4.1.7= 4.1.8= 4.1.9= 4.2.0= 4.2.1= 4.2.2= 4.2.3= 4.2.4= 4.2.5≤ 4.2.6 |
strongSwan 4.2.6 and earlier allows remote attackers to cause a denial of service (daemon crash) via an IKE_SA_INIT message with a large number of NULL values in a Key Exchange payload, which triggers a NULL pointer dereference for the return value of the mpz_export function in the GNU Multiprecision Library (GMP).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free