CVE-2022-40617

2022-10-3106:15:00

Alpine Linux Development Team

security.alpinelinux.org

0.002 Low

EPSS

Percentile

52.8%

JSON

strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA) certificate that contains a CRL/OCSP URL that points to a server (under the attacker’s control) that doesn’t properly respond but (for example) just does nothing after the initial TCP handshake, or sends an excessive amount of application data.

OSVersionArchitecturePackageVersionFilename
Alpineedge-mainnoarchstrongswan< 5.9.8-r0UNKNOWN
Alpine3.13-mainnoarchstrongswan< 5.9.1-r2UNKNOWN
Alpine3.14-mainnoarchstrongswan< 5.9.1-r3UNKNOWN
Alpine3.15-mainnoarchstrongswan< 5.9.1-r4UNKNOWN
Alpine3.16-mainnoarchstrongswan< 5.9.5-r2UNKNOWN
Alpine3.17-mainnoarchstrongswan< 5.9.8-r0UNKNOWN
Alpine3.18-mainnoarchstrongswan< 5.9.8-r0UNKNOWN
Alpine3.19-mainnoarchstrongswan< 5.9.8-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	edge-main	noarch	strongswan	< 5.9.8-r0	UNKNOWN
Alpine	3.13-main	noarch	strongswan	< 5.9.1-r2	UNKNOWN
Alpine	3.14-main	noarch	strongswan	< 5.9.1-r3	UNKNOWN
Alpine	3.15-main	noarch	strongswan	< 5.9.1-r4	UNKNOWN
Alpine	3.16-main	noarch	strongswan	< 5.9.5-r2	UNKNOWN
Alpine	3.17-main	noarch	strongswan	< 5.9.8-r0	UNKNOWN
Alpine	3.18-main	noarch	strongswan	< 5.9.8-r0	UNKNOWN
Alpine	3.19-main	noarch	strongswan	< 5.9.8-r0	UNKNOWN