CVE-2022-40617

Name	CVE-2022-40617
Description	strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA) certificate that contains a CRL/OCSP URL that points to a server (under the attacker's control) that doesn't properly respond but (for example) just does nothing after the initial TCP handshake, or sends an excessive amount of application data.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3143-1, DSA-5249-1
Debian Bugs	1021271

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
strongswan (PTS)	bullseye (security), bullseye	5.9.1-1+deb11u4	fixed
	bookworm, bookworm (security)	5.9.8-5+deb12u1	fixed
	sid, trixie	5.9.13-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
strongswan	source	buster	5.7.2-1+deb10u3	DLA-3143-1
strongswan	source	bullseye	5.9.1-1+deb11u3	DSA-5249-1
strongswan	source	(unstable)	5.9.8-1		1021271

Notes

https://www.strongswan.org/blog/2022/10/03/strongswan-vulnerability-(cve-2022-40617).html
Patch: https://download.strongswan.org/security/CVE-2022-40617/