CVE-2021-41991: Debian Linux

High severity, CVSS 7.5. EPSS: 5.3% chance of exploitation in the next 30 days.

The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries. The code attempts to select a less-often-used cache entry by means of a random number generator, but this is not done correctly. Remote code execution might be a slight possibility.

Affected products

  • Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
  • Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
  • Siemens CP 1543-1 Firmware: affected versions not specified
  • Siemens Scalance SC622-2c Firmware: affected versions not specified
  • Siemens Scalance SC632-2c Firmware: affected versions not specified
  • Siemens Scalance SC636-2c Firmware: affected versions not specified
  • Siemens Scalance SC642-2c Firmware: affected versions not specified
  • Siemens Scalance SC646-2c Firmware: before 2.3 (fixed in 2.3)
  • Siemens SIMATIC CP 1242-7 Gprs v2 Firmware: affected versions not specified
  • Siemens SIMATIC CP 1243-1 Firmware: affected versions not specified
  • Siemens SIMATIC CP 1243-7 Lte/us Firmware: affected versions not specified
  • Siemens SIMATIC CP 1542sp-1 Firmware: affected versions not specified
  • Siemens SIMATIC CP 1542sp-1 Irc Firmware: affected versions not specified
  • Siemens SIMATIC CP 1543sp-1 Firmware: affected versions not specified
  • Siemens SIMATIC Net CP1243-7 Lte Eu Firmware: affected versions not specified
  • Siemens SIMATIC Net CP 1243-8 Irc Firmware: affected versions not specified
  • Siemens SIMATIC Net CP 1545-1 Firmware: affected versions not specified
  • Siemens Sinema Remote Connect Server: affected versions not specified
  • Siemens Siplus Et 200sp CP 1542sp-1 Irc Tx Rail Firmware: affected versions not specified
  • Siemens Siplus Et 200sp CP 1543sp-1 Isec Firmware: affected versions not specified
  • Siemens Siplus Et 200sp CP 1543sp-1 Isec Tx Rail Firmware: affected versions not specified
  • Siemens Siplus Net CP 1543-1 Firmware: affected versions not specified
  • Siemens Siplus s7-1200 CP 1243-1 Firmware: affected versions not specified
  • Siemens Siplus s7-1200 CP 1243-1 Rail Firmware: affected versions not specified
  • Strongswan Strongswan: from 4.2.10, before 5.9.4 (fixed in 5.9.4)

Published 2021-10-18. Last modified 2026-06-17.