CVE-2021-41990: Integer Overflow
Published Oct 18, 2021
·Updated
The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. For example, this can be triggered by an unrelated self-signed CA certificate sent by an initiator. Remote code execution cannot occur.
Affected Software
75 affected componentsFixes available
debian/strongswan
5.7.2-1+deb10u25.7.2-1+deb10u35.9.1-1+deb11u35.9.8-55.9.11-1
strongSwan Strongswan>=5.6.1<5.9.4
Debian Debian Linux=10.0
Debian Debian Linux=11.0
Fedoraproject Fedora=33
Fedoraproject Fedora=34
Fedoraproject Fedora=35
All of the following
Siemens 6gk6108-4am00-2ba2 Firmware
Siemens 6gk6108-4am00-2ba2
All of the following
Siemens 6gk6108-4am00-2da2 Firmware
Siemens 6gk6108-4am00-2da2
All of the following
Siemens 6gk5804-0ap00-2aa2 Firmware
Siemens 6gk5804-0ap00-2aa2
All of the following
Siemens 6gk5812-1aa00-2aa2 Firmware
Siemens 6gk5812-1aa00-2aa2
All of the following
Siemens 6gk5812-1ba00-2aa2 Firmware
Siemens 6gk5812-1ba00-2aa2
All of the following
Siemens 6gk5816-1aa00-2aa2 Firmware
Siemens 6gk5816-1aa00-2aa2
All of the following
Siemens 6gk5816-1ba00-2aa2 Firmware
Siemens 6gk5816-1ba00-2aa2
All of the following
Siemens 6gk5826-2ab00-2ab2 Firmware
Siemens 6gk5826-2ab00-2ab2
All of the following
Siemens 6gk5874-2aa00-2aa2 Firmware
Siemens 6gk5874-2aa00-2aa2
All of the following
Siemens 6gk5874-3aa00-2aa2 Firmware
Siemens 6gk5874-3aa00-2aa2
All of the following
Siemens 6gk5876-3aa02-2ba2 Firmware
Siemens 6gk5876-3aa02-2ba2
All of the following
Siemens 6gk5876-3aa02-2ea2 Firmware
Siemens 6gk5876-3aa02-2ea2
All of the following
Siemens 6gk5876-4aa00-2ba2 Firmware
Siemens 6gk5876-4aa00-2ba2
All of the following
Siemens 6gk5876-4aa00-2da2 Firmware
Siemens 6gk5876-4aa00-2da2
All of the following
Siemens 6gk5856-2ea00-3da1 Firmware
Siemens 6gk5856-2ea00-3da1
All of the following
Siemens 6gk5856-2ea00-3aa1 Firmware
Siemens 6gk5856-2ea00-3aa1
All of the following
Siemens 6gk5615-0aa00-2aa2 Firmware
Siemens 6gk5615-0aa00-2aa2
Siemens 6gk6108-4am00-2ba2 Firmware
Siemens 6gk6108-4am00-2ba2
Siemens 6gk6108-4am00-2da2 Firmware
Siemens 6gk6108-4am00-2da2
Siemens 6gk5804-0ap00-2aa2 Firmware
Siemens 6gk5804-0ap00-2aa2
Siemens 6gk5812-1aa00-2aa2 Firmware
Siemens 6gk5812-1aa00-2aa2
Siemens 6gk5812-1ba00-2aa2 Firmware
Siemens 6gk5812-1ba00-2aa2
Siemens 6gk5816-1aa00-2aa2 Firmware
Siemens 6gk5816-1aa00-2aa2
Siemens 6gk5816-1ba00-2aa2 Firmware
Siemens 6gk5816-1ba00-2aa2
Siemens 6gk5826-2ab00-2ab2 Firmware
Siemens 6gk5826-2ab00-2ab2
Siemens 6gk5874-2aa00-2aa2 Firmware
Siemens 6gk5874-2aa00-2aa2
Siemens 6gk5874-3aa00-2aa2 Firmware
Siemens 6gk5874-3aa00-2aa2
Siemens 6gk5876-3aa02-2ba2 Firmware
Siemens 6gk5876-3aa02-2ba2
Siemens 6gk5876-3aa02-2ea2 Firmware
Siemens 6gk5876-3aa02-2ea2
Siemens 6gk5876-4aa00-2ba2 Firmware
Siemens 6gk5876-4aa00-2ba2
Siemens 6gk5876-4aa00-2da2 Firmware
Siemens 6gk5876-4aa00-2da2
Siemens 6gk5856-2ea00-3da1 Firmware
Siemens 6gk5856-2ea00-3da1
Siemens 6gk5856-2ea00-3aa1 Firmware
Siemens 6gk5856-2ea00-3aa1
Siemens 6gk5615-0aa00-2aa2 Firmware
Siemens 6gk5615-0aa00-2aa2
Event History
Oct 18, 2021
CVE Published
via MITRE·01:44 PM
Data Sourced
via MITRE·01:44 PM
Description
Data Sourced
via NVD·02:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2021-41990?
CVE-2021-41990 is a vulnerability in the gmp plugin in strongSwan before version 5.9.4.
2
How does CVE-2021-41990 work?
CVE-2021-41990 is a remote integer overflow vulnerability that can be triggered by a crafted certificate with an RSASSA-PSS signature.
3
What is the severity of CVE-2021-41990?
CVE-2021-41990 has a severity rating of 7.5 (high).
4
Is remote code execution possible with CVE-2021-41990?
No, remote code execution cannot occur with CVE-2021-41990.
5
How can I fix CVE-2021-41990?
You can fix CVE-2021-41990 by updating to strongSwan version 5.9.4 or later.