critical9.1
CVE-2021-45079
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP …
Impact
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Strongswan | Strongswan | from 4.1.2 before 5.9.5 |
| Debian | Debian Linux | Versions 9.0, 10.0, 11.0 |
| Fedoraproject | Extra Packages For Enterprise Linux | Versions 7.0, 8.0, 9.0 |
| Fedoraproject | Fedora | Versions 34, 35 |
| Canonical | Ubuntu Linux | Versions 14.04, 16.04, 18.04, 20.04, 21.10 |