Read the docs
TI-2011-03592 Aliases CVE-2011-4073GHSA-p53h-4vvv-85x4

Use-after-free vulnerability in the cryptographic helper handler functionality in…

Priority LOW 23CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-399 and the CVSS impact.

Summary

Use-after-free vulnerability in the cryptographic helper handler functionality in Openswan 2.3.0 through 2.6.36 allows remote authenticated users to cause a denial of service (pluto IKE daemon crash) via vectors related to the (1) quick_outI1_continue and (2) quick_outI1 functions.

Why it matters now

EPSS 0.02086 81st percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 73

CPEVersionsRoleVendor
cpe:2.3:a:xelerance:openswan:2.3.0:*:*:*:*:*:*:*2.3.0VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.3.1:*:*:*:*:*:*:*2.3.1VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.0:*:*:*:*:*:*:*2.4.0VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.1:*:*:*:*:*:*:*2.4.1VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.2:*:*:*:*:*:*:*2.4.2VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.3:*:*:*:*:*:*:*2.4.3VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.4:*:*:*:*:*:*:*2.4.4VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.5:*:*:*:*:*:*:*2.4.5VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.6:*:*:*:*:*:*:*2.4.6VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.7:*:*:*:*:*:*:*2.4.7VulnerableXelerance
  • cpe:2.3:a:xelerance:openswan:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.2:*:*:*:*:*:*:* Versions 2.4.2 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.3:*:*:*:*:*:*:* Versions 2.4.3 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.4:*:*:*:*:*:*:* Versions 2.4.4 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.5:*:*:*:*:*:*:* Versions 2.4.5 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.6:*:*:*:*:*:*:* Versions 2.4.6 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.7:*:*:*:*:*:*:* Versions 2.4.7 Vulnerable ·Xelerance
Show 63 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:xelerance:openswan:2.4.8:*:*:*:*:*:*:*2.4.8VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.9:*:*:*:*:*:*:*2.4.9VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.10:*:*:*:*:*:*:*2.4.10VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.11:*:*:*:*:*:*:*2.4.11VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.12:*:*:*:*:*:*:*2.4.12VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.4.13:*:*:*:*:*:*:*2.4.13VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.0:*:*:*:*:*:*:*2.5.0VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.0:sbs4:*:*:*:*:*:*2.5.0 sbs4VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.0:sbs5:*:*:*:*:*:*2.5.0 sbs5VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.01:*:*:*:*:*:*:*2.5.01VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.02:*:*:*:*:*:*:*2.5.02VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.03:*:*:*:*:*:*:*2.5.03VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.04:*:*:*:*:*:*:*2.5.04VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.05:*:*:*:*:*:*:*2.5.05VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.06:*:*:*:*:*:*:*2.5.06VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.07:*:*:*:*:*:*:*2.5.07VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.08:*:*:*:*:*:*:*2.5.08VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.09:*:*:*:*:*:*:*2.5.09VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.10:*:*:*:*:*:*:*2.5.10VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.11:*:*:*:*:*:*:*2.5.11VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.12:*:*:*:*:*:*:*2.5.12VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.13:*:*:*:*:*:*:*2.5.13VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.14:*:*:*:*:*:*:*2.5.14VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.15:*:*:*:*:*:*:*2.5.15VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.16:*:*:*:*:*:*:*2.5.16VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.17:*:*:*:*:*:*:*2.5.17VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.5.18:*:*:*:*:*:*:*2.5.18VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.01:*:*:*:*:*:*:*2.6.01VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.02:*:*:*:*:*:*:*2.6.02VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.03:*:*:*:*:*:*:*2.6.03VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.04:*:*:*:*:*:*:*2.6.04VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.05:*:*:*:*:*:*:*2.6.05VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.06:*:*:*:*:*:*:*2.6.06VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.07:*:*:*:*:*:*:*2.6.07VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.08:*:*:*:*:*:*:*2.6.08VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.09:*:*:*:*:*:*:*2.6.09VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.10:*:*:*:*:*:*:*2.6.10VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.11:*:*:*:*:*:*:*2.6.11VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.12:*:*:*:*:*:*:*2.6.12VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.13:*:*:*:*:*:*:*2.6.13VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.14:*:*:*:*:*:*:*2.6.14VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.15:*:*:*:*:*:*:*2.6.15VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.16:*:*:*:*:*:*:*2.6.16VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.17:*:*:*:*:*:*:*2.6.17VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.18:*:*:*:*:*:*:*2.6.18VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.19:*:*:*:*:*:*:*2.6.19VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.20:*:*:*:*:*:*:*2.6.20VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.21:*:*:*:*:*:*:*2.6.21VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.22:*:*:*:*:*:*:*2.6.22VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.23:*:*:*:*:*:*:*2.6.23VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.24:*:*:*:*:*:*:*2.6.24VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.25:*:*:*:*:*:*:*2.6.25VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.26:*:*:*:*:*:*:*2.6.26VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.27:*:*:*:*:*:*:*2.6.27VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.28:*:*:*:*:*:*:*2.6.28VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.29:*:*:*:*:*:*:*2.6.29VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.30:*:*:*:*:*:*:*2.6.30VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.31:*:*:*:*:*:*:*2.6.31VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.32:*:*:*:*:*:*:*2.6.32VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.33:*:*:*:*:*:*:*2.6.33VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.34:*:*:*:*:*:*:*2.6.34VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.35:*:*:*:*:*:*:*2.6.35VulnerableXelerance
cpe:2.3:a:xelerance:openswan:2.6.36:*:*:*:*:*:*:*2.6.36VulnerableXelerance
  • cpe:2.3:a:xelerance:openswan:2.4.8:*:*:*:*:*:*:* Versions 2.4.8 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.9:*:*:*:*:*:*:* Versions 2.4.9 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.10:*:*:*:*:*:*:* Versions 2.4.10 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.11:*:*:*:*:*:*:* Versions 2.4.11 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.12:*:*:*:*:*:*:* Versions 2.4.12 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.4.13:*:*:*:*:*:*:* Versions 2.4.13 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.0:sbs4:*:*:*:*:*:* Versions 2.5.0 sbs4 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.0:sbs5:*:*:*:*:*:* Versions 2.5.0 sbs5 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.01:*:*:*:*:*:*:* Versions 2.5.01 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.02:*:*:*:*:*:*:* Versions 2.5.02 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.03:*:*:*:*:*:*:* Versions 2.5.03 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.04:*:*:*:*:*:*:* Versions 2.5.04 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.05:*:*:*:*:*:*:* Versions 2.5.05 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.06:*:*:*:*:*:*:* Versions 2.5.06 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.07:*:*:*:*:*:*:* Versions 2.5.07 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.08:*:*:*:*:*:*:* Versions 2.5.08 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.09:*:*:*:*:*:*:* Versions 2.5.09 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.10:*:*:*:*:*:*:* Versions 2.5.10 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.11:*:*:*:*:*:*:* Versions 2.5.11 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.12:*:*:*:*:*:*:* Versions 2.5.12 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.13:*:*:*:*:*:*:* Versions 2.5.13 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.14:*:*:*:*:*:*:* Versions 2.5.14 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.15:*:*:*:*:*:*:* Versions 2.5.15 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.16:*:*:*:*:*:*:* Versions 2.5.16 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.17:*:*:*:*:*:*:* Versions 2.5.17 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.5.18:*:*:*:*:*:*:* Versions 2.5.18 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.01:*:*:*:*:*:*:* Versions 2.6.01 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.02:*:*:*:*:*:*:* Versions 2.6.02 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.03:*:*:*:*:*:*:* Versions 2.6.03 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.04:*:*:*:*:*:*:* Versions 2.6.04 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.05:*:*:*:*:*:*:* Versions 2.6.05 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.06:*:*:*:*:*:*:* Versions 2.6.06 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.07:*:*:*:*:*:*:* Versions 2.6.07 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.08:*:*:*:*:*:*:* Versions 2.6.08 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.09:*:*:*:*:*:*:* Versions 2.6.09 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.10:*:*:*:*:*:*:* Versions 2.6.10 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.11:*:*:*:*:*:*:* Versions 2.6.11 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.12:*:*:*:*:*:*:* Versions 2.6.12 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.13:*:*:*:*:*:*:* Versions 2.6.13 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.14:*:*:*:*:*:*:* Versions 2.6.14 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.15:*:*:*:*:*:*:* Versions 2.6.15 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.16:*:*:*:*:*:*:* Versions 2.6.16 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.17:*:*:*:*:*:*:* Versions 2.6.17 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.18:*:*:*:*:*:*:* Versions 2.6.18 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.19:*:*:*:*:*:*:* Versions 2.6.19 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.20:*:*:*:*:*:*:* Versions 2.6.20 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.21:*:*:*:*:*:*:* Versions 2.6.21 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.22:*:*:*:*:*:*:* Versions 2.6.22 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.23:*:*:*:*:*:*:* Versions 2.6.23 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.24:*:*:*:*:*:*:* Versions 2.6.24 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.25:*:*:*:*:*:*:* Versions 2.6.25 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.26:*:*:*:*:*:*:* Versions 2.6.26 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.27:*:*:*:*:*:*:* Versions 2.6.27 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.28:*:*:*:*:*:*:* Versions 2.6.28 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.29:*:*:*:*:*:*:* Versions 2.6.29 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.30:*:*:*:*:*:*:* Versions 2.6.30 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.31:*:*:*:*:*:*:* Versions 2.6.31 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.32:*:*:*:*:*:*:* Versions 2.6.32 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.33:*:*:*:*:*:*:* Versions 2.6.33 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.34:*:*:*:*:*:*:* Versions 2.6.34 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.35:*:*:*:*:*:*:* Versions 2.6.35 Vulnerable ·Xelerance
  • cpe:2.3:a:xelerance:openswan:2.6.36:*:*:*:*:*:*:* Versions 2.6.36 Vulnerable ·Xelerance

Remediation

Red Hat 1 advisory

  • RHSA-2011:1422 Released 2011-11-02 · Red Hat rating Moderate
    openswan security update
    • Red Hat Enterprise Linux (v. 5 server) openswan-2.6.21-5.el5_7.6, openswan-2.6.21-5.el5_7.6.i386, openswan-2.6.21-5.el5_7.6.ia64 +5
    • Red Hat Enterprise Linux Desktop (v. 5 client) openswan-2.6.21-5.el5_7.6, openswan-2.6.21-5.el5_7.6.i386, openswan-doc-2.6.21-5.el5_7.6 +1
    • Red Hat Enterprise Linux Server (v. 6) openswan-2.6.32-4.el6_1.4
    • Red Hat Enterprise Linux Server Optional (v. 6) openswan-2.6.32-4.el6_1.4, openswan-doc-2.6.32-4.el6_1.4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2011:1422
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2011:1422
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2011:1422
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2011:1422

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-4073
  2. 2026-10-03 Alias added: GHSA-p53h-4vvv-85x4

References

Advisory 2

Other 1

  • TI-2005-03466 The Internet Key Exchange version 1 (IKEv1) implementation in Openswan 2 (openswan-2)… CVSS 2.0HIGH 7.8
  • TI-2018-11286 In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the… CVSS 3.0HIGH 7.5
  • TI-2010-03162 Buffer overflow in programs/pluto/xauth.c in the client in Openswan 2.6.26 through 2.6.28… CVSS 2.0MEDIUM 6.5
  • TI-2013-01824 Buffer overflow in the atodn function in Openswan before 2.6.39, when Opportunistic… CVSS 2.0MEDIUM 6.8
  • TI-2010-03156 Buffer overflow in programs/pluto/xauth.c in the client in Openswan 2.6.25 through 2.6.28… CVSS 2.0MEDIUM 6.5
  • TI-2005-00141 Stack-based buffer overflow in the get_internal_addresses function in the pluto… CVSS 2.0HIGH 7.2
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences