CVE-2017-11185

What it actually does

Remote attacker can send a crafted RSA signature to the gmp plugin triggering a NULL pointer dereference that crashes the daemon.

Why it matters to the business

Disrupts availability of VPN and cryptographic services; with 98 downstream dependents the issue can cascade to many dependent packages and environments.

How an attack unfolds

An unauthenticated attacker crafts a malformed RSA signature and sends it over the network to a vulnerable strongSwan instance, causing an immediate NULL dereference crash with no authentication or user interaction required.

How to fix it

Upgrade affected installations to the fixed release; for tensorflow (Bitnami) update to version 2.1.4. Apply vendor patches or disable the gmp plugin if an upgrade is not immediately possible.

How to confirm the fix worked

Confirm the installed version is at or above the fixed release, review plugin configuration to ensure gmp is not loaded from older binaries, and perform connectivity tests to verify the service remains stable under crafted signature traffic.

Typical attack path

1. Identify a reachable strongSwan instance exposing the gmp plugin
2. Craft and transmit a malicious RSA signature in an IKE or related message
3. Trigger NULL pointer dereference leading to daemon termination

How to detect it

Review strongSwan daemon logs for abrupt crashes or NULL pointer messages around the time of RSA signature processing; correlate with network flow data showing unusual IKE traffic patterns.

What your security team should do

• Immediately inventory all strongSwan deployments and schedule upgrades to the fixed version
• Monitor EPSS and exploit maturity indicators for any change in risk posture
• Implement network segmentation and rate limiting around VPN endpoints until patches are applied