Auth bypass in Strongswan

CVE-2012-2388

The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability."

Vulnerability class: Broken Authentication

EPSS: 0.033 (87.3th percentile) — read the EPSS interpretation.

Affected products

  • Strongswan — versions 4.2.0, 4.2.1, 4.2.2
  • N/a — versions n/a

Weakness classification (CWE)

References