strongswan - Incorrect Handling of Early EAP-Success Messagesentered 2022-01-25
no CVE referenced
CVE details
CVE-2021-45079
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
- Score
- 9.1 critical
- Published
- 2022-01-31
- Links
- NVD · cve.org · Report wrong data
Matched ports (0)
No port is within the affected range.