PT-2023-2354 · Unknown+2 · Strongswan+2
Published
2023-03-03
·
Updated
2025-02-07
·
CVE-2023-26463
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
strongSwan versions 5.9.8 through 5.9.9
Description
The issue is related to incorrect access control and an expired pointer dereference due to the use of a variable named
public for two different purposes within the same function. This can potentially allow remote code execution. One attack vector is sending an untrusted client certificate during EAP-TLS. A server is affected only if it loads plugins that implement TLS-based EAP methods, such as EAP-TLS, EAP-TTLS, EAP-PEAP, or EAP-TNC.Recommendations
For strongSwan versions 5.9.8 and 5.9.9, update to version 5.9.10 to resolve the issue. As a temporary workaround, consider disabling the use of TLS-based EAP methods until the update is applied. Restrict access to the
public variable and ensure proper access control to minimize the risk of exploitation. Avoid using untrusted client certificates during EAP-TLS authentication.Fix
RCE
DoS
Improper Authorization
NULL Pointer Dereference
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Red Os
Strongswan