VulnerabilityModified
CVE-2014-9221
strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.
MEDIUM 5.0EPSS 3.82%
Does this matter?
Lower severity and a low EPSS score (3.82%). Track it; it rarely justifies an emergency change on its own.
Description
strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
- EPSS
- 3.82% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-19
- Affected
- strongswan/strongswan · opensuse/opensuse · canonical/ubuntu linux · fedoraproject/fedora · debian/debian linux
- Source
- cve@mitre.org
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153825.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-01/msg00054.htmlThird Party Advisory
- http://secunia.com/advisories/62071Permissions Required, Third Party Advisory
- http://secunia.com/advisories/62083
- http://secunia.com/advisories/62095Permissions Required, Third Party Advisory
- http://secunia.com/advisories/62663Permissions Required, Third Party Advisory
- http://strongswan.org/blog/2015/01/05/strongswan-5.2.2-released.htmlVendor Advisory
- http://strongswan.org/blog/2015/01/05/strongswan-denial-of-service-vulnerability-%28cve-2014-9221%29.html
- http://www.debian.org/security/2015/dsa-3118Third Party Advisory
- http://www.securityfocus.com/bid/71894
- http://www.ubuntu.com/usn/USN-2450-1Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153825.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-01/msg00054.htmlThird Party Advisory
- http://secunia.com/advisories/62071Permissions Required, Third Party Advisory
- http://secunia.com/advisories/62083
- http://secunia.com/advisories/62095Permissions Required, Third Party Advisory
- http://secunia.com/advisories/62663Permissions Required, Third Party Advisory
- http://strongswan.org/blog/2015/01/05/strongswan-5.2.2-released.htmlVendor Advisory
- http://strongswan.org/blog/2015/01/05/strongswan-denial-of-service-vulnerability-%28cve-2014-9221%29.html
- http://www.debian.org/security/2015/dsa-3118Third Party Advisory
- http://www.securityfocus.com/bid/71894
- http://www.ubuntu.com/usn/USN-2450-1Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.