Cyber Resilience

CVE-2021-41991

High

Published: 18 October 2021

Published
18 October 2021
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0294 86.7th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-41991 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Debian Debian Linux. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 13.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries. The code attempts to select a less-often-used cache…

more

entry by means of a random number generator, but this is not done correctly. Remote code execution might be a slight possibility.

CWE(s)
CWE-190

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

strongswan
strongswan
4.2.10 — 5.9.4
debian
debian linux
10.0, 11.0, 9.0
fedoraproject
fedora
33, 34, 35
siemens
sinema remote connect server
all versions
siemens
siplus et 200sp cp 1542sp-1 irc tx rail firmware
all versions
siemens
simatic cp 1243-1 firmware
all versions
siemens
simatic cp 1242-7 gprs v2 firmware
all versions
siemens
simatic net cp 1243-8 irc firmware
all versions
siemens
scalance sc632-2c firmware
all versions
siemens
siplus et 200sp cp 1543sp-1 isec firmware
all versions
+15 more product configuration(s) — see NVD for full list

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References