Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2022-40617

Опубликовано: 31 окт. 2022
Источник: nvd
CVSS3: 7.5
EPSS Низкий

Описание

strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA) certificate that contains a CRL/OCSP URL that points to a server (under the attacker's control) that doesn't properly respond but (for example) just does nothing after the initial TCP handshake, or sends an excessive amount of application data.

Ссылки

Уязвимые конфигурации

Конфигурация 1
cpe:2.3:a:strongswan:strongswan:*:*:*:*:*:*:*:*
Версия до 5.9.8 (исключая)
Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*
Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Конфигурация 4
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Конфигурация 5

Одно из

cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*
Версия от 3.11.1 (включая) до 3.11.20 (исключая)
cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*
Версия от 4.3.1 (включая) до 4.3.15 (исключая)
cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*
Версия от 4.5.1 (включая) до 4.6.0 (исключая)

EPSS

Процентиль: 41%
0.00195
Низкий

7.5 High

CVSS3

Дефекты

CWE-400
CWE-400

Связанные уязвимости

ubuntu логотип

CVE-2022-40617

CVSS3: 7.5
ubuntu
больше 3 лет назад

strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA) certificate that contains a CRL/OCSP URL that points to a server (under the attacker's control) that doesn't properly respond but (for example) just does nothing after the initial TCP handshake, or sends an excessive amount of application data.

msrc логотип

CVE-2022-40617

CVSS3: 7.5
msrc
около 3 лет назад

strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA) certificate that contains a CRL/OCSP URL that points to a server (under the attacker's control) that doesn't properly respond but (for example) just does nothing after the initial TCP handshake or sends an excessive amount of application data.

debian логотип

CVE-2022-40617

CVSS3: 7.5
debian
больше 3 лет назад

strongSwan before 5.9.8 allows remote attackers to cause a denial of s ...

suse-cvrf логотип

SUSE-SU-2022:4197-1

suse-cvrf
около 3 лет назад

Security update for strongswan

suse-cvrf логотип

SUSE-SU-2022:4185-1

suse-cvrf
около 3 лет назад

Security update for strongswan

EPSS

Процентиль: 41%
0.00195
Низкий

7.5 High

CVSS3

Дефекты

CWE-400
CWE-400