CVE catalog

CVE-2022-4967

strongswan: CVE-2022-4967

Severity: Medium
Published: May 13, 2024, 6:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.47% · Oct 25, 2026

strongSwan versions 5.9.2 through 5.9.5 are affected by authorization bypass through improper validation of certificate with host mismatch (CWE-297). When certificates are used to authenticate clients in TLS-based EAP methods, the IKE or EAP identity supplied by a client is not enforced to be contained in the client's certificate. So clients can authenticate with any trusted certificate and claim an arbitrary IKE/EAP identity as their own. This is problematic if the identity is used to make policy decisions. A fix was released in strongSwan version 5.9.6 in August 2022 (e4b4aabc4996fc61c37deab7858d07bc4d220136).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	strongswan	sid	`6.1.0-2`	fixed
Debian	strongswan	forky	`6.1.0-2`	fixed
Debian	strongswan	trixie	`6.0.1-6+deb13u6`	fixed
Debian	strongswan	trixie-security	`6.0.1-6+deb13u7`	fixed
Debian	strongswan	bookworm	`5.9.8-5+deb12u5`	fixed
Debian	strongswan	bookworm-security	`5.9.8-5+deb12u5`	fixed
Ubuntu	strongswan	22.04	`5.9.1-1ubuntu3`	vulnerable
Ubuntu	strongswan	22.04	`5.9.1-1ubuntu3.1`	vulnerable
Ubuntu	strongswan	22.04	`5.9.4-1ubuntu1`	vulnerable
Ubuntu	strongswan	22.04	`5.9.4-1ubuntu2`	vulnerable
Ubuntu	strongswan	22.04	`5.9.4-1ubuntu3`	vulnerable
Ubuntu	strongswan	22.04	`5.9.4-1ubuntu4`	vulnerable
Ubuntu	strongswan	22.04	`5.9.5-2ubuntu1`	vulnerable
Ubuntu	strongswan	22.04	`5.9.5-2ubuntu2`	vulnerable
Ubuntu	strongswan	22.04	`5.9.5-2ubuntu2.1`	vulnerable
Ubuntu	strongswan	22.04	`5.9.5-2ubuntu2.2`	vulnerable
Ubuntu	strongswan	22.04	`5.9.5-2ubuntu2.3`	fixed
Ubuntu	strongswan	22.04	`5.9.1-1ubuntu3`	vulnerable
Ubuntu	strongswan	22.04	`5.9.1-1ubuntu3.1`	vulnerable
Ubuntu	strongswan	22.04	`5.9.4-1ubuntu1`	vulnerable
Ubuntu	strongswan	22.04	`5.9.4-1ubuntu2`	vulnerable
Ubuntu	strongswan	22.04	`5.9.4-1ubuntu3`	vulnerable
Ubuntu	strongswan	22.04	`5.9.4-1ubuntu4`	vulnerable
Ubuntu	strongswan	22.04	`5.9.5-2ubuntu1`	vulnerable
Ubuntu	strongswan	22.04	`5.9.5-2ubuntu2`	vulnerable
Ubuntu	strongswan	22.04	`5.9.5-2ubuntu2.1`	vulnerable
Ubuntu	strongswan	22.04	`5.9.5-2ubuntu2.2`	vulnerable
Ubuntu	strongswan	22.04	`5.9.5-2ubuntu2.3`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	strongswan	source	sid	`5.9.6-1`	not yet assigned	Not reported	Not reported
Debian	strongswan	source	forky	`5.9.6-1`	not yet assigned	Not reported	Not reported
Debian	strongswan	source	trixie	`5.9.6-1`	not yet assigned	Not reported	Not reported
Debian	strongswan	source	bookworm	`5.9.6-1`	not yet assigned	Not reported	Not reported
Ubuntu	strongswan	deb	22.04	`5.9.5-2ubuntu2.3`	Not reported	USN-6772-1	Not reported
Ubuntu	strongswan	deb	22.04	`5.9.5-2ubuntu2.3`	Not reported	UBUNTU-CVE-2022-4967	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[charon-cmd]Unknown
Source package: [strongswan]
Details (4)
- 5.9.8-5+deb12u5 · amd64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · amd64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
[charon-systemd]Unknown
Source package: [strongswan]
Details (4)
- 5.9.8-5+deb12u5 · amd64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · amd64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
[libcharon-extauth-plugins]Unknown
Source package: [strongswan]
Details (4)
- 5.9.8-5+deb12u5 · amd64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · amd64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
[libcharon-extra-plugins]Unknown
Source package: [strongswan]
Details (4)
- 5.9.8-5+deb12u5 · amd64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · amd64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
[libstrongswan]Unknown
Source package: [strongswan]
Details (4)
- 5.9.8-5+deb12u5 · amd64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · amd64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
[libstrongswan-extra-plugins]Unknown
Source package: [strongswan]
Details (4)
- 5.9.8-5+deb12u5 · amd64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · amd64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
[libstrongswan-standard-plugins]Unknown
Source package: [strongswan]
Details (4)
- 5.9.8-5+deb12u5 · amd64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · amd64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
[strongswan]Unknown
Details (4)
- 5.9.8-5+deb12u5 · all · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · all · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · all · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · all · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
[strongswan-charon]Unknown
Source package: [strongswan]
Details (4)
- 5.9.8-5+deb12u5 · amd64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · amd64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
[strongswan-libcharon]Unknown
Source package: [strongswan]
Details (4)
- 5.9.8-5+deb12u5 · amd64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · amd64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
[strongswan-nm]Unknown
Source package: [strongswan]
Details (4)
- 5.9.8-5+deb12u5 · amd64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · amd64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
[strongswan-pki]Unknown
Source package: [strongswan]
Details (4)
- 5.9.8-5+deb12u5 · amd64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · amd64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
[strongswan-starter]Unknown
Source package: [strongswan]
Details (4)
- 5.9.8-5+deb12u5 · amd64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · amd64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
[strongswan-swanctl]Unknown
Source package: [strongswan]
Details (4)
- 5.9.8-5+deb12u5 · amd64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · amd64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm
- 5.9.8-5+deb12u5 · arm64 · bookworm-security
  Fixed · Fixed: 5.9.6-1
  dsa · strongswan · debian · bookworm

Observed: Oct 23, 2026, 6:59:10 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]