CVE-2017-9023

Name	CVE-2017-9023
Description	The ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allows remote attackers to cause a denial of service (infinite loop) via a crafted certificate.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DLA-973-1, DSA-3866-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
strongswan (PTS)	buster	5.7.2-1+deb10u2	fixed
	buster (security)	5.7.2-1+deb10u3	fixed
	bullseye (security), bullseye	5.9.1-1+deb11u3	fixed
	bookworm, sid	5.9.8-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
strongswan	source	wheezy	4.5.2-1.5+deb7u9	DLA-973-1
strongswan	source	jessie	5.2.1-6+deb8u3	DSA-3866-1
strongswan	source	(unstable)	5.5.1-4

upstream fix https://git.strongswan.org/?p=strongswan.git;a=commit;h=407fcca200fdf6a41a04ac0885a770b6b53c5d23