CVE-2023-26463

Name

CVE-2023-26463

Description

strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function. There is initially incorrect access control, later followed by an expired pointer dereference. One attack vector is sending an untrusted client certificate during EAP-TLS. A server is affected only if it loads plugins that implement TLS-based EAP methods (EAP-TLS, EAP-TTLS, EAP-PEAP, or EAP-TNC). This is fixed in 5.9.10.

NVD Severity

high

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

Type	URI
MISC	https://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-%28cve-2023-26463%29.html
MISC	https://github.com/strongswan/strongswan/releases
MISC	https://security.netapp.com/advisory/ntap-20230517-0010/

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:strongswan:strongswan:5.9.9:-::::::`	strongswan	== None	== 5.9.9
`cpe:2.3:a:strongswan:strongswan:5.9.8:-::::::`	strongswan	== None	== 5.9.8

References

Match rules

Vulnerable and fixed packages