Unscored severity · published May 2, 2013
CVE-2013-2944
strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as other users via an invalid signature
–
CVSS
1.6%
EPSS
No
On KEV
Description
strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as other users via an invalid signature.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Strongswan · Strongswan
4.3.5; 4.3.6; 4.3.7; 4.4.0; 4.4.1; 4.5.0; +11 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2944
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2944
Patch
http://download.strongswan.org/patches/10_openssl_ecdsa_signature_patch/strongswan-4.3.5-5.0.3_openssl_ecdsa_signature.patch
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-05/msg00014.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-06/msg00010.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-06/msg00121.html
www.debian.org
http://www.debian.org/security/2013/dsa-2665
www.securityfocus.com
http://www.securityfocus.com/bid/59580
More from Strongswan
9.8
CVE-2023-41913
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy
9.8
CVE-2023-26463
strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function
9.8
CVE-2015-3991
strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code
9.1
CVE-2021-45079
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual…
8.1
CVE-2025-62291
In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow…