4.9
CVE-2013-2944
- EPSS 1.59%
- Veröffentlicht 02.05.2013 14:55:05
- Zuletzt bearbeitet 29.04.2026 01:13:23
- Erkennungen
LoginstrongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as other users via an invalid signature.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Strongswan ≫ Strongswan Version 4.3.5
Strongswan ≫ Strongswan Version 4.3.6
Strongswan ≫ Strongswan Version 4.3.7
Strongswan ≫ Strongswan Version 4.4.0
Strongswan ≫ Strongswan Version 4.4.1
Strongswan ≫ Strongswan Version 4.5.0
Strongswan ≫ Strongswan Version 4.5.1
Strongswan ≫ Strongswan Version 4.5.2
Strongswan ≫ Strongswan Version 4.5.3
Strongswan ≫ Strongswan Version 4.6.0
Strongswan ≫ Strongswan Version 4.6.1
Strongswan ≫ Strongswan Version 4.6.2
Strongswan ≫ Strongswan Version 4.6.3
Strongswan ≫ Strongswan Version 4.6.4
Strongswan ≫ Strongswan Version 5.0.0
Strongswan ≫ Strongswan Version 5.0.1
Strongswan ≫ Strongswan Version 5.0.2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.59% | 0.724 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 4.9 | 6.8 | 4.9 |
AV:N/AC:M/Au:S/C:P/I:P/A:N
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
http://download.strongswan.org/patches/10_openssl_ecdsa_signature_patch/strongswan-4.3.5-5.0.3_openssl_ecdsa_signature.patch
http://lists.opensuse.org/opensuse-updates/2013-05/msg00014.html
http://lists.opensuse.org/opensuse-updates/2013-06/msg00010.html
http://lists.opensuse.org/opensuse-updates/2013-06/msg00121.html
http://www.debian.org/security/2013/dsa-2665
http://www.securityfocus.com/bid/59580
http://www.strongswan.org/blog/2013/04/30/strongswan-5.0.4-released-%28cve-2013-2944%29.html