CVE-2021-41990: Debian Linux

High severity, CVSS 7.5. EPSS: 6.7% chance of exploitation in the next 30 days.

The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. For example, this can be triggered by an unrelated self-signed CA certificate sent by an initiator. Remote code execution cannot occur.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
• Siemens 6gk5615-0aa00-2aa2 Firmware: affected versions not specified
• Siemens 6gk5804-0ap00-2aa2 Firmware: affected versions not specified
• Siemens 6gk5812-1aa00-2aa2 Firmware: affected versions not specified
• Siemens 6gk5812-1ba00-2aa2 Firmware: affected versions not specified
• Siemens 6gk5816-1aa00-2aa2 Firmware: affected versions not specified
• Siemens 6gk5816-1ba00-2aa2 Firmware: affected versions not specified
• Siemens 6gk5826-2ab00-2ab2 Firmware: affected versions not specified
• Siemens 6gk5856-2ea00-3aa1 Firmware: affected versions not specified
• Siemens 6gk5856-2ea00-3da1 Firmware: affected versions not specified
• Siemens 6gk5874-2aa00-2aa2 Firmware: affected versions not specified
• Siemens 6gk5874-3aa00-2aa2 Firmware: affected versions not specified
• Siemens 6gk5876-3aa02-2ba2 Firmware: affected versions not specified
• Siemens 6gk5876-3aa02-2ea2 Firmware: affected versions not specified
• Siemens 6gk5876-4aa00-2ba2 Firmware: affected versions not specified
• Siemens 6gk5876-4aa00-2da2 Firmware: affected versions not specified
• Siemens 6gk6108-4am00-2ba2 Firmware: affected versions not specified
• Siemens 6gk6108-4am00-2da2 Firmware: affected versions not specified
• Strongswan Strongswan: from 5.6.1, before 5.9.4 (fixed in 5.9.4)

Published 2021-10-18. Last modified 2026-06-17.