Critical Vulnerability in StrongSwan: PKCS#1 Signature Forgery Risk
Summary
ALPINE-CVE-2018-16151: In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data after the encoded algorithm OID during PK... Affects strongswan versions < 5.7.0-r0. Fixed in 5.7.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
StrongSwan is an open-source IPsec-based VPN solution that provides secure communication over the internet. It is widely used for establishing secure connections in various environments, including corporate networks and cloud services. The package is known for its flexibility, supporting multiple protocols and authentication methods. However, it is vulnerable to a specific issue in its RSA implementation, which could allow attackers to forge signatures under certain conditions.
Vulnerability Detail
The vulnerability arises from the verify_emsa_pkcs1_signature() function in the gmp_rsa_public_key.c file within the GMP plugin of StrongSwan versions 4.x and 5.x prior to 5.7.0. The RSA implementation does not adequately reject excess data following the encoded algorithm OID during PKCS#1 v1.5 signature verification. This flaw can be exploited by remote attackers using small public exponents to forge signatures, potentially leading to impersonation during IKEv2 authentication. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
5.7.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade strongswanTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider using larger public exponents for RSA keys to mitigate the risk of signature forgery until the package can be updated.
Conclusion
The vulnerability in StrongSwan poses a significant risk due to its potential for allowing signature forgery. It is crucial for users to update to the patched version to safeguard against possible impersonation attacks. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for strongswan →
FAQ
The vulnerability allows attackers to forge RSA signatures due to improper handling of excess data during signature verification.
Check your StrongSwan version against the patched version (5.7.0 or later). If you are using an earlier version, you are at risk.
Exploitation could lead to impersonation attacks, allowing unauthorized access to secure communications.
Yes, you can use Vulert, which monitors open-source vulnerabilities in real-time using a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for strongswan.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
