Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 29

Export CSV
CVE-2023-2295

libreswan: Regression of CVE-2023-30570 fixes in the Red Hat Enterprise Linux

A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote code execution is possible. This CVE exists because of a CVE-2023-30570 security regression for libreswan package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Libreswan Redhat
Products
Libreswan Enterprise Linux Enterprise Linux Eus and 4 more
CVE-2023-30570

libreswan: Malicious IKEv1 Aggressive Mode packets can crash libreswan

pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The earliest affected version is 3.28.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Libreswan Redhat
Products
Libreswan Enterprise Linux Openshift and 4 more
CVE-2023-38710

libreswan: Invalid IKEv2 REKEY proposal causes restart

An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent back. The notify payload's protocol ID is copied from the incoming packet, but the code that verifies outgoing packets fails an assertion that the protocol ID must be ESP (2) or AH(3) and causes the pluto daemon to crash and restart. NOTE: the earliest affected version is 3.20.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Libreswan Redhat
Products
Libreswan Enterprise Linux Openshift and 2 more
CVE-2023-38712

libreswan: Invalid IKEv1 repeat IKE SA delete causes crash and restart

An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the deleted state causes the pluto daemon to crash and restart.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Libreswan Redhat
Products
Libreswan Enterprise Linux Openshift and 2 more
CVE-2023-38711

libreswan: Invalid IKEv1 Quick Mode ID causes restart

An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN, a NULL pointer dereference causes a crash and restart of the pluto daemon. NOTE: the earliest affected version is 4.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Libreswan Redhat
Products
Libreswan Enterprise Linux Openshift and 2 more
CVE-2022-23094

libreswan: Malicious IKEv1 packet can cause libreswan to restart

Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. This is fixed in 4.6.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Debian Fedoraproject Libreswan and 1 more
Products
Debian Linux Fedora Libreswan and 2 more
CVE-2020-1763

libreswan: DoS attack via malicious IKEv1 informational exchange message

An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Libreswan Redhat
Products
Libreswan Enterprise Linux Rhel E4s and 1 more
CVE-2019-12312

libreswan: null-pointer dereference by sending two IKEv2 packets

In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.

CVSS 3.0 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Libreswan Redhat
Products
Libreswan Enterprise Linux
CVE-2019-10155

libreswan: vulnerability in the processing of IKEv1 informational packets due to missing integrity check

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Libreswan Redhat and 2 more
Products
Fedora Libreswan Enterprise Linux and 2 more