TI-2022-04556 Aliases CVE-2022-4967 GHSA-2hrc-c28p-9f59

strongSwan versions 5.9.2 through 5.9.5 are affected by authorization bypass through…

LOW 34Published 2024-05-13 · Updated 2025-02-13

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

strongSwan versions 5.9.2 through 5.9.5 are affected by authorization bypass through improper validation of certificate with host mismatch (CWE-297). When certificates are used to authenticate clients in TLS-based EAP methods, the IKE or EAP identity supplied by a client is not enforced to be contained in the client's certificate. So clients can authenticate with any trusted certificate and claim an arbitrary IKE/EAP identity as their own. This is problematic if the identity is used to make policy decisions. A fix was released in strongSwan version 5.9.6 in August 2022 (e4b4aabc4996fc61c37deab7858d07bc4d220136).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00464 40th percentileScored 2026-11-07

Fix Fixed strongSwan (strongSwan): 5.9.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
strongSwan	strongSwan	5.9.2 to before 5.9.6	5.9.6	Patch available	CNA

strongSwan VendorstrongSwan Affected 5.9.2 to before 5.9.6 Fixed in 5.9.6 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:strongswan:strongswan::::::::	5.9.2 to before 5.9.6	Vulnerable	strongSwan

cpe:2.3:a:strongswan:strongswan:*:*:*:*:*:*:*:* Versions 5.9.2 to before 5.9.6 Vulnerable ·strongSwan

Remediation

Fix · CNA strongSwan (strongSwan) Fixed in 5.9.6

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2022-4967
2026-10-03 Alias added: GHSA-2hrc-c28p-9f59

References

Patch 1

https://github.com/strongswan/strongswan/commit/e4b4aabc4996fc61c37deab7858d07bc4d220136

Advisory 3

TI-2023-22300 strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code… CVSS 3.1CRITICAL 9.8
TI-2015-03374 strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon… CVSS 3.0CRITICAL 9.8
TI-2004-00531 FreeS/WAN 1.x and 2.x, and other related products including superfreeswan 1.x, openswan… CVSS 2.0HIGH 10.0
TI-2023-11610 strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a… CVSS 3.1CRITICAL 9.8
TI-2021-20414 In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too… CVSS 3.1CRITICAL 9.1
TI-2017-08240 The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of… CVSS 3.1HIGH 7.5

See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences