Skip to content
fr Sign in
8.2 High

CVE-2024-21894 A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an…

Description

A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack. In certain conditions this may lead to execution of arbitrary code

Affected products and versions

Product Affected versions Fixed in
connect_secure 22.6R2.3 No fix stated
connect_secure 22.5 22.5R1.3 → 22.5R2.4 No fix stated
connect_secure 22.4 22.4R1.2 → 22.4R2.4 No fix stated
connect_secure 22.3R1.2 No fix stated
connect_secure 22.2R4.2 No fix stated
connect_secure 22.1R6.2 No fix stated
connect_secure 9.1 9.1R14.6 → 9.1R18.5 No fix stated
policy_secure 22.6R1.2 No fix stated
policy_secure 22.4R1.2 No fix stated
Show the 11 other branches
Product Affected versions Fixed in
policy_secure 9.1 9.1R16.4 → 9.1R18.5 No fix stated
Connect Secure 22.6 earliest → < 22.6R2.3 22.6R2.3
Connect Secure 22.5 earliest → < 22.5R2.4 22.5R1.3
Connect Secure 22.4 earliest → < 22.4R2.4 22.4R1.2
Connect Secure 22.3 earliest → < 22.3R1.2 22.3R1.2
Connect Secure 22.2 earliest → < 22.2R4.2 22.2R4.2
Connect Secure 22.1 earliest → < 22.1R6.2 22.1R6.2
Connect Secure 9.1 earliest → < 9.1R18.5 9.1R14.6
Policy Secure 22.6 earliest → < 22.6R1.2 22.6R1.2
Policy Secure 22.4 earliest → < 22.4R1.2 22.4R1.2
Policy Secure 9.1 earliest → < 9.1R18.5 9.1R16.4

References

Timeline

  1. Published
  2. Last modified

Other CVEs of connect_secure

The 24 CVEs of connect_secure →
CVE-2024-37400 An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to… 7.5 High CVE-2024-39709 Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy… 7.8 High CVE-2024-38656 Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version… 9.1 Critical CVE-2024-39710 Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version… 9.1 Critical
Track this CVE