CVE-2022-4967

strongSwan versions 5.9.2 through 5.9.5 are affected by authorization bypass through improper validation of certificate with host mismatch (CWE-297). When certificates are used to authenticate clients in TLS-based EAP methods, the IKE or EAP identity supplied by a client is not enforced to be contained in the client's certificate. So clients can authenticate with any trusted certificate and claim an arbitrary IKE/EAP identity as their own. This is problematic if the identity is used to make policy decisions. A fix was released in strongSwan version 5.9.6 in August 2022 (e4b4aabc4996fc61c37deab7858d07bc4d220136).

References

Affected packages

Git / github.com/strongswan/strongswan

Affected ranges

Type: GIT
Repo: https://github.com/strongswan/strongswan
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

e4b4aabc4996fc61c37deab7858d07bc4d220136

Affected versions

4.*

4.0.0

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

4.0.6

4.0.7

4.1.0

4.1.1

4.1.10

4.1.11

4.1.2

4.1.3

4.1.4

4.1.5

4.1.6

4.1.7

4.1.8

4.1.9

4.2.0

4.2.1

4.2.10

4.2.11

4.2.12

4.2.13

4.2.14

4.2.2

4.2.3

4.2.4

4.2.5

4.2.6

4.2.7

4.2.8

4.2.9

4.3.0

4.3.1

4.3.2

4.3.3

4.3.4

4.3.5

4.3.5rc1

4.3.6

4.4.0

4.4.1

4.5.0

4.5.1

4.5.2

4.5.3

4.6.0

4.6.1

4.6.2

4.6.3

5.*

5.0.0

5.0.1

5.0.2

5.0.2dr4

5.0.2rc1

5.0.3

5.0.3dr1

5.0.3dr2

5.0.3dr3

5.0.3rc1

5.0.4

5.1.0

5.1.0dr1

5.1.0dr2

5.1.0rc1

5.1.1

5.1.1dr1

5.1.1dr2

5.1.1dr3

5.1.1dr4

5.1.1rc1

5.1.2

5.1.2.dr2

5.1.2dr1

5.1.2dr3

5.1.2rc1

5.1.2rc2

5.1.3

5.1.3dr1

5.1.3rc1

5.2.0

5.2.0dr1

5.2.0dr2

5.2.0dr3

5.2.0dr4

5.2.0dr5

5.2.0dr6

5.2.0rc1

5.2.1

5.2.1dr1

5.2.1rc1

5.2.2

5.2.2dr1

5.2.2rc1

5.3.0

5.3.0dr1

5.3.0rc1

5.3.1

5.3.1dr1

5.3.1rc1

5.3.2

5.3.3

5.3.3dr1

5.3.3dr3

5.3.3dr4

5.3.3dr5

5.3.3dr6

5.3.3rc2

5.3.4

5.3.4dr1

5.3.4dr2

5.3.4dr3

5.3.4rc1

5.3.5

5.4.0

5.4.0dr1

5.4.0dr2

5.4.0dr3

5.4.0dr4

5.4.0dr5

5.4.0dr6

5.4.0dr7

5.4.0dr8

5.4.0rc1

5.4.1dr1

5.4.1dr2

5.4.1dr3

5.4.1dr4

5.5.0

5.5.0dr1

5.5.0rc1

5.5.1

5.5.1dr1

5.5.1dr2

5.5.1dr3

5.5.1dr4

5.5.1dr5

5.5.1rc1

5.5.1rc2

5.5.2

5.5.2dr1

5.5.2dr2

5.5.2dr3

5.5.2dr4

5.5.2dr5

5.5.2dr6

5.5.2dr7

5.5.2rc1

5.5.3

5.5.3dr1

5.5.3dr2

5.6.0

5.6.0dr1

5.6.0dr2

5.6.0dr3

5.6.0dr4

5.6.0rc1

5.6.0rc2

5.6.1

5.6.1dr1

5.6.1dr2

5.6.1dr3

5.6.1rc1

5.6.2

5.6.2dr1

5.6.2dr2

5.6.2dr3

5.6.2dr4

5.6.2rc1

5.6.3

5.6.3dr1

5.6.3dr2

5.6.3rc1

5.7.0

5.7.0dr1

5.7.0dr2

5.7.0dr3

5.7.0dr4

5.7.0dr5

5.7.0dr6

5.7.0dr8

5.7.0rc1

5.7.0rc2

5.7.1

5.7.2

5.7.2dr1

5.7.2dr2

5.7.2dr3

5.7.2dr4

5.7.2rc1

5.8.0

5.8.0dr2

5.8.0rc1

5.8.1

5.8.1dr1

5.8.1rc2

5.8.2

5.8.2dr1

5.8.2dr2

5.8.2rc1

5.8.2rc2

5.8.3

5.8.3rc1

5.8.4

5.9.0

5.9.0dr1

5.9.0dr2

5.9.0rc1

5.9.1

5.9.1dr1

5.9.1rc1

5.9.2

5.9.2dr1

5.9.2dr2

5.9.2rc1

5.9.2rc2

5.9.3

5.9.3dr1

5.9.3dr2

5.9.3dr3

5.9.3dr4

5.9.3rc1

5.9.4

5.9.4dr1

5.9.4dr2

5.9.4dr3

5.9.4rc1

5.9.5

5.9.5dr1

5.9.5dr2

5.9.5dr3

5.9.5dr4

5.9.5rc1

android-2.*

android-2.3.3

android-2.3.3-1

Database specific

vanir_signatures

[
    {
        "digest": {
            "length": 1629.0,
            "function_hash": "229327423693068019333482254977440631366"
        },
        "id": "CVE-2022-4967-1a12fff4",
        "source": "https://github.com/strongswan/strongswan/commit/e4b4aabc4996fc61c37deab7858d07bc4d220136",
        "signature_type": "Function",
        "target": {
            "file": "src/libtls/tls_peer.c",
            "function": "send_key_exchange_encrypt"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "length": 585.0,
            "function_hash": "40996807859007373074460075075838764263"
        },
        "id": "CVE-2022-4967-598d9ae1",
        "source": "https://github.com/strongswan/strongswan/commit/e4b4aabc4996fc61c37deab7858d07bc4d220136",
        "signature_type": "Function",
        "target": {
            "file": "src/libtls/tls_server.c",
            "function": "tls_find_public_key"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "length": 812.0,
            "function_hash": "10058219289210136812147994005291638990"
        },
        "id": "CVE-2022-4967-5eec59fb",
        "source": "https://github.com/strongswan/strongswan/commit/e4b4aabc4996fc61c37deab7858d07bc4d220136",
        "signature_type": "Function",
        "target": {
            "file": "src/libtls/tls_server.c",
            "function": "process_cert_verify"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "length": 820.0,
            "function_hash": "252755643761933897749899606010188678882"
        },
        "id": "CVE-2022-4967-97dbeaad",
        "source": "https://github.com/strongswan/strongswan/commit/e4b4aabc4996fc61c37deab7858d07bc4d220136",
        "signature_type": "Function",
        "target": {
            "file": "src/libtls/tls_peer.c",
            "function": "process_cert_verify"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "length": 1942.0,
            "function_hash": "216694263043041037499179477589224375067"
        },
        "id": "CVE-2022-4967-b7a2fe35",
        "source": "https://github.com/strongswan/strongswan/commit/e4b4aabc4996fc61c37deab7858d07bc4d220136",
        "signature_type": "Function",
        "target": {
            "file": "src/libtls/tls_peer.c",
            "function": "process_modp_key_exchange"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "length": 2717.0,
            "function_hash": "118434765318832376156361802437971748377"
        },
        "id": "CVE-2022-4967-de723e7c",
        "source": "https://github.com/strongswan/strongswan/commit/e4b4aabc4996fc61c37deab7858d07bc4d220136",
        "signature_type": "Function",
        "target": {
            "file": "src/libtls/tls_peer.c",
            "function": "process_ec_key_exchange"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "229400809894567376555921683802648030370",
                "224893881739257184856010924054928237201",
                "332345852565583412669789961522385218175",
                "9063154467130130065658916835352025303",
                "217507570939720489052883851071055495599",
                "311738739724082187616704889031676639100",
                "52385069922578192468510523726254989248",
                "227818797753182964353371269131837265845",
                "89522631616381438168524258764928273746",
                "77300050891222599619603736940655119474",
                "127863257509405125426456340302296568470",
                "8468002517573446442019565981308043882",
                "82232005207467064140640778972187898221",
                "77300050891222599619603736940655119474",
                "127863257509405125426456340302296568470",
                "8468002517573446442019565981308043882",
                "89522631616381438168524258764928273746",
                "77300050891222599619603736940655119474",
                "127863257509405125426456340302296568470",
                "8468002517573446442019565981308043882"
            ]
        },
        "id": "CVE-2022-4967-f20242b8",
        "source": "https://github.com/strongswan/strongswan/commit/e4b4aabc4996fc61c37deab7858d07bc4d220136",
        "signature_type": "Line",
        "target": {
            "file": "src/libtls/tls_peer.c"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "78515405905118962559508779596501436965",
                "17833456349906317718900164075029167902",
                "306932862811193668079133993590605667217",
                "169075892614574621953335468159410888208",
                "51704737262552831804433348024332176187",
                "195325518392457070668088786390150896718",
                "56071113674080884090147510379863010314",
                "256940141627077002244184166511049376041",
                "249757746048041252117052894885411958317",
                "134427150802605942791448424993548135032",
                "337209709849843004341933797566995272448",
                "63032851982266000158574236282466886001",
                "105357985101231697501845586005123878282"
            ]
        },
        "id": "CVE-2022-4967-fecf3d0f",
        "source": "https://github.com/strongswan/strongswan/commit/e4b4aabc4996fc61c37deab7858d07bc4d220136",
        "signature_type": "Line",
        "target": {
            "file": "src/libtls/tls_server.c"
        },
        "signature_version": "v1",
        "deprecated": false
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-4967.json"