Read the docs
TI-2009-02092 Aliases CVE-2009-2185GHSA-9g49-v8fv-gvm8

The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c…

Priority LOW 27CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.

Why it matters now

EPSS 0.02372 83rd percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 56

CPEVersionsRoleVendor
cpe:2.3:a:strongswan:strongswan:2.8.0:*:*:*:*:*:*:*2.8.0VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:2.8.1:*:*:*:*:*:*:*2.8.1VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:2.8.2:*:*:*:*:*:*:*2.8.2VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:2.8.3:*:*:*:*:*:*:*2.8.3VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:2.8.4:*:*:*:*:*:*:*2.8.4VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:2.8.5:*:*:*:*:*:*:*2.8.5VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:2.8.6:*:*:*:*:*:*:*2.8.6VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:2.8.7:*:*:*:*:*:*:*2.8.7VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:2.8.8:*:*:*:*:*:*:*2.8.8VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:2.8.9:*:*:*:*:*:*:*2.8.9VulnerablestrongSwan
  • cpe:2.3:a:strongswan:strongswan:2.8.0:*:*:*:*:*:*:* Versions 2.8.0 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:2.8.1:*:*:*:*:*:*:* Versions 2.8.1 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:2.8.2:*:*:*:*:*:*:* Versions 2.8.2 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:2.8.3:*:*:*:*:*:*:* Versions 2.8.3 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:2.8.4:*:*:*:*:*:*:* Versions 2.8.4 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:2.8.5:*:*:*:*:*:*:* Versions 2.8.5 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:2.8.6:*:*:*:*:*:*:* Versions 2.8.6 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:2.8.7:*:*:*:*:*:*:* Versions 2.8.7 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:2.8.8:*:*:*:*:*:*:* Versions 2.8.8 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:2.8.9:*:*:*:*:*:*:* Versions 2.8.9 Vulnerable ·strongSwan
Show 46 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:strongswan:strongswan:2.8.10:*:*:*:*:*:*:*2.8.10VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.1:*:*:*:*:*:*:*4.1VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.2.0:*:*:*:*:*:*:*4.2.0VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.2.1:*:*:*:*:*:*:*4.2.1VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.2.2:*:*:*:*:*:*:*4.2.2VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.2.3:*:*:*:*:*:*:*4.2.3VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.2.4:*:*:*:*:*:*:*4.2.4VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.2.5:*:*:*:*:*:*:*4.2.5VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.2.6:*:*:*:*:*:*:*4.2.6VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.2.7:*:*:*:*:*:*:*4.2.7VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.2.8:*:*:*:*:*:*:*4.2.8VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.2.9:*:*:*:*:*:*:*4.2.9VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.2.10:*:*:*:*:*:*:*4.2.10VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.2.11:*:*:*:*:*:*:*4.2.11VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.2.12:*:*:*:*:*:*:*4.2.12VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.2.13:*:*:*:*:*:*:*4.2.13VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.2.14:*:*:*:*:*:*:*4.2.14VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.2.15:*:*:*:*:*:*:*4.2.15VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.3.0:*:*:*:*:*:*:*4.3.0VulnerablestrongSwan
cpe:2.3:a:strongswan:strongswan:4.3.1:*:*:*:*:*:*:*4.3.1VulnerablestrongSwan
cpe:2.3:a:xelerance:openswan:2.4.0:*:*:*:*:*:*:*2.4.0VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.1:*:*:*:*:*:*:*2.4.1VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.2:*:*:*:*:*:*:*2.4.2VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.3:*:*:*:*:*:*:*2.4.3VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.4:*:*:*:*:*:*:*2.4.4VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.5:*:*:*:*:*:*:*2.4.5VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.9:*:*:*:*:*:*:*2.4.9VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.10:*:*:*:*:*:*:*2.4.10VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.03:*:*:*:*:*:*:*2.6.03VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.04:*:*:*:*:*:*:*2.6.04VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.05:*:*:*:*:*:*:*2.6.05VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.06:*:*:*:*:*:*:*2.6.06VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.07:*:*:*:*:*:*:*2.6.07VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.08:*:*:*:*:*:*:*2.6.08VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.09:*:*:*:*:*:*:*2.6.09VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.10:*:*:*:*:*:*:*2.6.10VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.11:*:*:*:*:*:*:*2.6.11VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.12:*:*:*:*:*:*:*2.6.12VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.13:*:*:*:*:*:*:*2.6.13VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.14:*:*:*:*:*:*:*2.6.14VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.15:*:*:*:*:*:*:*2.6.15VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.16:*:*:*:*:*:*:*2.6.16VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.17:*:*:*:*:*:*:*2.6.17VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.18:*:*:*:*:*:*:*2.6.18VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.19:*:*:*:*:*:*:*2.6.19VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.20:*:*:*:*:*:*:*2.6.20VulnerableXelerance
  • cpe:2.3:a:strongswan:strongswan:2.8.10:*:*:*:*:*:*:* Versions 2.8.10 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.2.2:*:*:*:*:*:*:* Versions 4.2.2 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.2.3:*:*:*:*:*:*:* Versions 4.2.3 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.2.4:*:*:*:*:*:*:* Versions 4.2.4 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.2.5:*:*:*:*:*:*:* Versions 4.2.5 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.2.6:*:*:*:*:*:*:* Versions 4.2.6 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.2.7:*:*:*:*:*:*:* Versions 4.2.7 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.2.8:*:*:*:*:*:*:* Versions 4.2.8 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.2.9:*:*:*:*:*:*:* Versions 4.2.9 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.2.10:*:*:*:*:*:*:* Versions 4.2.10 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.2.11:*:*:*:*:*:*:* Versions 4.2.11 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.2.12:*:*:*:*:*:*:* Versions 4.2.12 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.2.13:*:*:*:*:*:*:* Versions 4.2.13 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.2.14:*:*:*:*:*:*:* Versions 4.2.14 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.2.15:*:*:*:*:*:*:* Versions 4.2.15 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·strongSwan
  • cpe:2.3:a:strongswan:strongswan:4.3.1:*:*:*:*:*:*:* Versions 4.3.1 Vulnerable ·strongSwan
  • cpe:2.3:a:xelerance:openswan:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.2:*:*:*:*:*:*:* Versions 2.4.2 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.3:*:*:*:*:*:*:* Versions 2.4.3 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.4:*:*:*:*:*:*:* Versions 2.4.4 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.5:*:*:*:*:*:*:* Versions 2.4.5 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.9:*:*:*:*:*:*:* Versions 2.4.9 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.10:*:*:*:*:*:*:* Versions 2.4.10 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.03:*:*:*:*:*:*:* Versions 2.6.03 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.04:*:*:*:*:*:*:* Versions 2.6.04 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.05:*:*:*:*:*:*:* Versions 2.6.05 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.06:*:*:*:*:*:*:* Versions 2.6.06 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.07:*:*:*:*:*:*:* Versions 2.6.07 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.08:*:*:*:*:*:*:* Versions 2.6.08 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.09:*:*:*:*:*:*:* Versions 2.6.09 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.10:*:*:*:*:*:*:* Versions 2.6.10 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.11:*:*:*:*:*:*:* Versions 2.6.11 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.12:*:*:*:*:*:*:* Versions 2.6.12 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.13:*:*:*:*:*:*:* Versions 2.6.13 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.14:*:*:*:*:*:*:* Versions 2.6.14 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.15:*:*:*:*:*:*:* Versions 2.6.15 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.16:*:*:*:*:*:*:* Versions 2.6.16 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.17:*:*:*:*:*:*:* Versions 2.6.17 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.18:*:*:*:*:*:*:* Versions 2.6.18 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.19:*:*:*:*:*:*:* Versions 2.6.19 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.20:*:*:*:*:*:*:* Versions 2.6.20 Vulnerable ·Xelerance

Remediation

Red Hat 1 advisory

  • RHSA-2009:1138 Released 2009-07-02 · Red Hat rating Important
    openswan security update
    • Red Hat Enterprise Linux (v. 5 server) openswan-2.6.14-1.el5_3.3, openswan-2.6.14-1.el5_3.3.i386, openswan-2.6.14-1.el5_3.3.ia64 +5
    • Red Hat Enterprise Linux Desktop (v. 5 client) openswan-2.6.14-1.el5_3.3, openswan-2.6.14-1.el5_3.3.i386, openswan-doc-2.6.14-1.el5_3.3 +1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2009:1138
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2009:1138

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-2185
  2. 2026-10-03 Alias added: GHSA-9g49-v8fv-gvm8

References

Advisory 9

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences