The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libreswan | Aug 22, 2024 | May 24, 2019 |
| Centos_linux | — | Upgrade libreswan-debuginfoUpgrade libreswan-debugsourceUpgrade libreswan | Apr 8, 2020 | May 24, 2019 |
| Debian | — | Upgrade libreswan | Jul 30, 2024 | May 24, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libreswan | Aug 31, 2020 | May 24, 2019 |
| Redhat_linux | — | Upgrade libreswan-debuginfoUpgrade libreswan-debugsourceUpgrade libreswan | Apr 8, 2020 | May 24, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub