← Database

CVE-2021-45079

CRITICAL CVSS: 9.1 Published: 2022-01-31 Modified: 2026-06-17

Description

In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.

Affected Platforms

Canonical Ubuntu LinuxFedoraproject Extra Packages For Enterprise LinuxStrongswan StrongswanFedoraproject FedoraDebian Debian Linux

Weakness Type

CWE-476

References