strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA) certificate that contains a CRL/OCSP URL that points to a server (under the attacker's control) that doesn't properly respond but (for example) just does nothing after the initial TCP handshake or sends an excessive amount of application data.

🗓️ 09 Nov 2022 08:00:00Reported by MicrosoftType

StrongSwan before 5.9.8 enables remote denial of service via crafted certificate using certificate revocation list and online certificate status

Reporter	Title	Published	Views	Family All 67
FreeBSD	strongswan -- DOS attack vulnerability	3 Oct 202200:00	–	freebsd
AlpineLinux	CVE-2022-40617	31 Oct 202200:00	–	alpinelinux
AstraLinux	Astra Linux – Vulnerability in StrongSwan	19 Jun 202611:10	–	astralinux
BDU FSTEC	The vulnerability of the StrongSwan client’s revocation VPN plugin, related to uncontrolled resource consumption, allows a violator to trigger a service failure.	23 Sep 202400:00	–	bdu_fstec
CBLMariner	CVE-2022-40617 affecting package strongswan for versions less than 5.9.8-1	3 Jan 202320:57	–	cbl_mariner
CBLMariner	CVE-2022-40617 affecting package strongswan 5.7.2-5	2 Mar 202304:18	–	cbl_mariner
CNNVD	strongSwan 资源管理错误漏洞	4 Oct 202200:00	–	cnnvd
CNVD	strongSwan trust management issue vulnerability	11 Oct 202200:00	–	cnvd
CVE	CVE-2022-40617	31 Oct 202200:00	–	cve
Cvelist	CVE-2022-40617	31 Oct 202200:00	–	cvelist