# CVE-2022-4967: strongswan: strongSwan versions 5.9.2 through 5.9.5 are affected by authorization bypass through improper validation of certifica...

CVE-2022-4967 is fixed in 15 products on 1 platform, first by charon-cmd 5.9.5-2ubuntu2.3, released May 13, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2022-4967
- Priority: Routine
- CVSS: 6.5 (medium)
- EPSS: 0.0046
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 13, 2024

## Description

strongSwan versions 5.9.2 through 5.9.5 are affected by authorization bypass through improper validation of certificate with host mismatch (CWE-297). When certificates are used to authenticate clients in TLS-based EAP methods, the IKE or EAP identity supplied by a client is not enforced to be contained in the client's certificate. So clients can authenticate with any trusted certificate and claim an arbitrary IKE/EAP identity as their own. This is problematic if the identity is used to make policy decisions. A fix was released in strongSwan version 5.9.6 in August 2022 (e4b4aabc4996fc61c37deab7858d07bc4d220136).

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | charon-cmd Ubuntu 22.04.1 LTS (jammy) | 5.9.5-2ubuntu2.3 | [charon-cmd 5.9.5-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-charon-cmd-5.9.5-2ubuntu2.3.md) | May 13, 2024 |
| Linux | charon-systemd Ubuntu 22.04.1 LTS (jammy) | 5.9.5-2ubuntu2.3 | [charon-systemd 5.9.5-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-charon-systemd-5.9.5-2ubuntu2.3.md) | May 13, 2024 |
| Linux | libcharon-extauth-plugins Ubuntu 22.04.1 LTS (jammy) | 5.9.5-2ubuntu2.3 | [libcharon-extauth-plugins 5.9.5-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libcharon-extauth-plugins-5.9.5-2ubuntu2.3.md) | May 13, 2024 |
| Linux | libcharon-extra-plugins Ubuntu 22.04.1 LTS (jammy) | 5.9.5-2ubuntu2.3 | [libcharon-extra-plugins 5.9.5-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libcharon-extra-plugins-5.9.5-2ubuntu2.3.md) | May 13, 2024 |
| Linux | libstrongswan Ubuntu 22.04.1 LTS (jammy) | 5.9.5-2ubuntu2.3 | [libstrongswan 5.9.5-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libstrongswan-5.9.5-2ubuntu2.3.md) | May 13, 2024 |
| Linux | libstrongswan-extra-plugins Ubuntu 22.04.1 LTS (jammy) | 5.9.5-2ubuntu2.3 | [libstrongswan-extra-plugins 5.9.5-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libstrongswan-extra-plugins-5.9.5-2ubuntu2.3.md) | May 13, 2024 |
| Linux | libstrongswan-standard-plugins Ubuntu 22.04.1 LTS (jammy) | 5.9.5-2ubuntu2.3 | [libstrongswan-standard-plugins 5.9.5-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libstrongswan-standard-plugins-5.9.5-2ubuntu2.3.md) | May 13, 2024 |
| Linux | strongswan Debian 12.15 (bookworm) | 5.9.6-1 | [DEBIAN-CVE-2022-4967](https://patchblox.com/security/data/fix/linux/debian-cve-2022-4967.md) | May 14, 2024 |
| Linux | strongswan Debian 13.5 (trixie) | 5.9.6-1 | [DEBIAN-CVE-2022-4967](https://patchblox.com/security/data/fix/linux/debian-cve-2022-4967.md) | May 14, 2024 |
| Linux | strongswan Debian 14 | 5.9.6-1 | [DEBIAN-CVE-2022-4967](https://patchblox.com/security/data/fix/linux/debian-cve-2022-4967.md) | May 14, 2024 |
| Linux | strongswan Ubuntu 22.04.1 LTS (jammy) | 5.9.5-2ubuntu2.3 | [strongswan 5.9.5-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-strongswan-5.9.5-2ubuntu2.3.md) | May 13, 2024 |
| Linux | strongswan-charon Ubuntu 22.04.1 LTS (jammy) | 5.9.5-2ubuntu2.3 | [strongswan-charon 5.9.5-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-strongswan-charon-5.9.5-2ubuntu2.3.md) | May 13, 2024 |
| Linux | strongswan-libcharon Ubuntu 22.04.1 LTS (jammy) | 5.9.5-2ubuntu2.3 | [strongswan-libcharon 5.9.5-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-strongswan-libcharon-5.9.5-2ubuntu2.3.md) | May 13, 2024 |
| Linux | strongswan-nm Ubuntu 22.04.1 LTS (jammy) | 5.9.5-2ubuntu2.3 | [strongswan-nm 5.9.5-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-strongswan-nm-5.9.5-2ubuntu2.3.md) | May 13, 2024 |
| Linux | strongswan-pki Ubuntu 22.04.1 LTS (jammy) | 5.9.5-2ubuntu2.3 | [strongswan-pki 5.9.5-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-strongswan-pki-5.9.5-2ubuntu2.3.md) | May 13, 2024 |
| Linux | strongswan-scepclient Ubuntu 22.04.1 LTS (jammy) | 5.9.5-2ubuntu2.3 | [strongswan-scepclient 5.9.5-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-strongswan-scepclient-5.9.5-2ubuntu2.3.md) | May 13, 2024 |
| Linux | strongswan-starter Ubuntu 22.04.1 LTS (jammy) | 5.9.5-2ubuntu2.3 | [strongswan-starter 5.9.5-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-strongswan-starter-5.9.5-2ubuntu2.3.md) | May 13, 2024 |
| Linux | strongswan-swanctl Ubuntu 22.04.1 LTS (jammy) | 5.9.5-2ubuntu2.3 | [strongswan-swanctl 5.9.5-2ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-strongswan-swanctl-5.9.5-2ubuntu2.3.md) | May 13, 2024 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.