CVE-2017-9022: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which allows remote peers to cause a denial of service (floating point exception and process crash) via a crafted certificate.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 16.10 only; version 17.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only
• Strongswan Strongswan: up to and including 5.5.2

Published 2017-06-08. Last modified 2026-06-17.