CVEvulnerability

CVE-2023-26463

9.8 CRITICAL Published 2023-04-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-04-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-295, CWE-476

Description

strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function. There is initially incorrect access control, later followed by an expired pointer dereference. One attack vector is sending an untrusted client certificate during EAP-TLS. A server is affected only if it loads plugins that implement TLS-based EAP methods (EAP-TLS, EAP-TTLS, EAP-PEAP, or EAP-TNC). This is fixed in 5.9.10.

Affected configurations

• strongswan strongswan 5.9.8 • strongswan strongswan 5.9.9

Related

Weakness · CWE (2)

  • CWE-295 Improper Certificate Validation weakness
  • CWE-476 NULL Pointer Dereference weakness

Referenced by CWE · observed example (3)

  • CWE-1109 Use of Same Variable for Multiple Purposes weakness
  • CWE-284 Improper Access Control weakness
  • CWE-825 Expired Pointer Dereference weakness

References