CVE-2022-4967: strongswan

csirt@kutim:~/threat-intel/cve/CVE-2022-4967

CVSS 6.5 · Medium EPSS 0,47%

Kerentanan pada strongswan. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

strongSwan versions 5.9.2 through 5.9.5 are affected by authorization bypass through improper validation of certificate with host mismatch (CWE-297). When certificates are used to authenticate clients in TLS-based EAP methods, the IKE or EAP identity supplied by a client is not enforced to be contained in the client's certificate. So clients can authenticate with any trusted certificate and claim an arbitrary IKE/EAP identity as their own. This is problematic if the identity is used to make policy decisions. A fix was released in strongSwan version 5.9.6 in August 2022 (e4b4aabc4996fc61c37deab7858d07bc4d220136).

Rincian

Terbit di NVD: 14 Mei 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
EPSS (30 hari): 0,47% peluang dieksploitasi; lebih tinggi dari 38,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
strongswan	strongswan	Versi 5.9.2 hingga sebelum 5.9.6

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.strongswan.org/blog/2024/05/13/strongswan-vulnerability-(cve-2022-4967).html mitigasi · advisory vendor
https://github.com/strongswan/strongswan/commit/e4b4aabc4996fc61c37deab7858d07bc4d220136 patch
https://security.netapp.com/advisory/ntap-20240614-0006/ advisory pihak ketiga
https://www.cve.org/CVERecord?id=CVE-2022-4967 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.