CVE-2021-45079: Canonical Ubuntu Linux

Critical severity, CVSS 9.1. EPSS: 2.8% chance of exploitation in the next 30 days.

In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only; version 20.04 only; version 21.10 only
• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Fedoraproject Extra Packages For Enterprise Linux: version 7.0 only; version 8.0 only; version 9.0 only
• Fedoraproject Fedora: version 34 only; version 35 only
• Strongswan Strongswan: from 4.1.2, before 5.9.5 (fixed in 5.9.5)

Published 2022-01-31. Last modified 2026-06-17.