Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2023-26463: strongSwan 5.9.8/5.9.9 remote code execution via crafted certificate
CVE-2023-26463 · published 3 years ago
Summary
Servers running strongSwan version 5.9.8 or 5.9.9 that load TLS‑based EAP plugins could be tricked into running malicious code if an attacker sends a specially crafted client certificate. The flaw is caused by a programming mistake that mishandles a variable and later uses a memory reference that is no longer valid. Upgrade to strongSwan 5.9.10 or later to eliminate the risk.
What to do
- Update debian strongswan to version 5.9.8-4.
- Update strongswan to version 5.9.10-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | strongswan |
< 5.9.8-4 Fix: upgrade to 5.9.8-4
|
| Debian:13 | debian | strongswan |
< 5.9.8-4 Fix: upgrade to 5.9.8-4
|
| Debian:14 | debian | strongswan |
< 5.9.8-4 Fix: upgrade to 5.9.8-4
|
| Alpine:v3.17 | – | strongswan |
< 5.9.10-r0 Fix: upgrade to 5.9.10-r0
|
| – | strongswan | strongswan |
5.9.8 5.9.9 cpe:2.3:a:strongswan:strongswan:5.9.8:-:*:*:*:*:*:* |
Original advisory text
strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function. There is initially incorrect acces...
strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function. There is initially incorrect access control, later followed by an expired pointer dereference. One attack vector is sending an untrusted client certificate during EAP-TLS. A server is affected only if it loads plugins that implement TLS-based EAP methods (EAP-TLS, EAP-TTLS, EAP-PEAP, or EAP-TNC). This is fixed in 5.9.10.
References
- https://security-tracker.debian.org/tracker/CVE-2023-26463 Vendor Advisory
- https://security.alpinelinux.org/vuln/CVE-2023-26463 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26463... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-26463 Vendor Advisory
- https://security.netapp.com/advisory/ntap-20230517-0010/ Vendor Advisory
- https://github.com/strongswan/strongswan/releases Product
- https://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-%28cve-2023-... Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
9.8
Critical
Type
CWE-295Improper Certificate Validation
CWE-476NULL Pointer Dereference
Timeline
Published15 Apr 2023
Updated30 Oct 2026
First seen15 Sep 2026
Sources
DEBIAN-CVE-2023-26463 · OSV
ALPINE-CVE-2023-26463 · OSV
CVE-2023-26463 · NVD
CVE-2023-26463 · OSV
Track software like this
Free during beta