CVE-2023-26463: Null Pointer Dereference
First published: Fri Apr 14 2023(Updated: )
strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function. There is initially incorrect access control, later followed by an expired pointer dereference. One attack vector is sending an untrusted client certificate during EAP-TLS. A server is affected only if it loads plugins that implement TLS-based EAP methods (EAP-TLS, EAP-TTLS, EAP-PEAP, or EAP-TNC). This is fixed in 5.9.10.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Strongswan Strongswan | =5.9.8 | |
| Strongswan Strongswan | =5.9.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-26463?
CVE-2023-26463 is a vulnerability in strongSwan 5.9.8 and 5.9.9 that potentially allows remote code execution.
What is the severity of CVE-2023-26463?
The severity of CVE-2023-26463 is 9.8 (critical).
How does CVE-2023-26463 allow remote code execution?
CVE-2023-26463 allows remote code execution by using a variable named "public" for two different purposes within the same function, leading to incorrect access control and an expired pointer dereference.
Which versions of strongSwan are affected by CVE-2023-26463?
strongSwan versions 5.9.8 and 5.9.9 are affected by CVE-2023-26463.
How can I fix CVE-2023-26463?
To fix CVE-2023-26463, upgrade to a version of strongSwan that is not affected by the vulnerability.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/strongswan
- canonical/strongswan strongswan
- version/strongswan strongswan/5.9.8
- version/strongswan strongswan/5.9.9