{"id":"CVE-2023-41913","details":"strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.","modified":"2026-08-12T03:51:25.864631761Z","published":"2023-12-07T00:00:00Z","related":["SUSE-SU-2023:4514-1","SUSE-SU-2023:4515-1","SUSE-SU-2023:4516-1","SUSE-SU-2023:4529-1"],"database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41913.json"},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00018.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YPJZPYHBCRXUQGGKQE6TYH4J4RIJH6HO/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41913.json"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPJZPYHBCRXUQGGKQE6TYH4J4RIJH6HO/"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41913"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20250117-0003/"},{"type":"PACKAGE","url":"https://github.com/strongswan/strongswan/releases"},{"type":"ARTICLE","url":"https://www.strongswan.org/blog/2023/11/20/strongswan-vulnerability-%28cve-2023-41913%29.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/strongswan/strongswan","events":[{"introduced":"ff96400d13e757385be62cab2df9f69a7d829040"},{"fixed":"11dbc8e7f271579c2cbe8496ca6bf8b12241803b"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"5.9.12"},{"introduced":"5.3.0"}],"source":["DESCRIPTION","CPE_RANGE"],"cpe":"cpe:2.3:a:strongswan:strongswan:*:*:*:*:*:*:*:*"}}],"versions":["5.9.12rc1","5.9.12dr2","5.9.12dr1","android-2.4.2","5.9.11","5.9.11rc1","5.9.11dr3","5.9.11dr2","5.9.11dr1","5.9.10","5.9.10rc1","android-2.4.1-1","android-2.4.1","android-2.4.0","5.9.9","5.9.9rc2","5.9.9rc1","5.9.8","5.9.8rc1","5.9.8dr4","5.9.8dr3","5.9.8dr2","5.9.8dr1","5.9.7","5.9.7rc1","5.9.7dr2","5.9.7dr1","5.9.6","5.9.6rc1","5.9.5","5.9.5rc1","5.9.5dr4","5.9.5dr3","5.9.5dr2","5.9.5dr1","5.9.4","5.9.4rc1","5.9.4dr3","5.9.4dr2","5.9.4dr1","android-2.3.3-1","android-2.3.3","5.9.3","5.9.3rc1","5.9.3dr4","5.9.3dr3","5.9.3dr2","5.9.3dr1","5.9.2","5.9.2rc2","5.9.2rc1","5.9.2dr2","5.9.2dr1","5.9.1","5.9.1rc1","5.9.1dr1","5.9.0","5.9.0rc1","5.9.0dr2","5.9.0dr1","5.8.4","5.8.3","5.8.3rc1","5.8.2","5.8.2rc2","5.8.2rc1","5.8.2dr2","5.8.2dr1","5.8.1","5.8.1rc2","5.8.1dr1","5.8.0","5.8.0rc1","5.8.0dr2","5.7.2","5.7.2rc1","5.7.2dr4","5.7.2dr3","5.7.2dr2","5.7.2dr1","5.7.1","5.7.0","5.7.0rc2","5.7.0rc1","5.7.0dr8","5.7.0dr6","5.7.0dr5","5.7.0dr4","5.7.0dr3","5.7.0dr2","5.7.0dr1","5.6.3","5.6.3rc1","5.6.3dr2","5.6.3dr1","5.6.2","5.6.2rc1","5.6.2dr4","5.6.2dr3","5.6.2dr2","5.6.2dr1","5.6.1","5.6.1rc1","5.6.1dr3","5.6.1dr2","5.6.1dr1","5.6.0","5.6.0rc2","5.6.0rc1","5.6.0dr4","5.6.0dr3","5.6.0dr2","5.6.0dr1","5.5.3","5.5.3dr2","5.5.3dr1","5.5.2","5.5.2rc1","5.5.2dr7","5.5.2dr6","5.5.2dr5","5.5.2dr4","5.5.2dr3","5.5.2dr2","5.5.2dr1","5.5.1","5.5.1rc2","5.5.1rc1","5.5.1dr5","5.5.1dr4","5.5.1dr3","5.5.1dr2","5.5.0","5.5.1dr1","5.5.0rc1","5.5.0dr1","5.4.1dr4","5.4.1dr3","5.4.1dr2","5.4.1dr1","5.4.0","5.4.0rc1","5.4.0dr8","5.4.0dr7","5.4.0dr6","5.4.0dr5","5.4.0dr4","5.4.0dr3","5.4.0dr2","5.4.0dr1","5.3.5","5.3.4","5.3.4rc1","5.3.4dr3","5.3.4dr2","5.3.4dr1","5.3.3","5.3.3rc2","5.3.3dr6","5.3.3dr5","5.3.3dr4","5.3.3dr3","5.3.3dr1","5.3.2","5.3.1","5.3.1rc1","5.3.1dr1","5.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-41913.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}