The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries. The code attempts to select a less-often-used cache entry by means of a random number generator but this is not done correctly. Remote code execution might be a slight possibility.

🗓️ 22 Oct 2021 07:00:00Reported by MicrosoftType

Remote integer overflow in strongSwan certificate cache before version five nine four with many unique certificates due to flawed random replacement, risking code execution.

Reporter	Title	Published	Views	Family All 85
FreeBSD	strongswan - denial-of-service vulnerability in the gmp plugin/denial-of-service vulnerability in the in-memory certificate cache	4 Oct 202100:00	–	freebsd
AlpineLinux	CVE-2021-41991	18 Oct 202113:44	–	alpinelinux
CBLMariner	CVE-2021-41991 affecting package strongswan 5.7.2-6	6 Nov 202100:29	–	cbl_mariner
CBLMariner	CVE-2021-41991 affecting package strongswan for versions less than 5.9.5-1	26 Apr 202220:17	–	cbl_mariner
Circl	CVE-2021-41991	18 Oct 202118:32	–	circl
CNNVD	strongSwan 输入验证错误漏洞	18 Oct 202100:00	–	cnnvd
CVE	CVE-2021-41991	18 Oct 202113:44	–	cve
Cvelist	CVE-2021-41991	18 Oct 202113:44	–	cvelist
Debian	[SECURITY] [DLA 2788-1] strongswan security update	19 Oct 202122:36	–	debian
Debian	[SECURITY] [DSA 4989-1] strongswan security update	18 Oct 202119:17	–	debian