CVE-2023-2295 — Uncontrolled Resource Consumption in Libreswan

CWE-400 — Uncontrolled Resource Consumption5 documents5 sources
Severity
7.5HIGHNVD
EPSS
1.6%
top 18.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
LibreswanRedhat Enterprise LinuxRedhat Enterprise Linux EUS+2 more
Timeline
PublishedMay 17
Latest updateMay 18

Description

A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote code execution is possible. This CVE exists because of a CVE-2023-30570 security regression for libres…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5libreswan/libreswanAffects libreswan v4.9-1.el8 and libreswan v4.9-1.el9, Fixed in libreswan v4.9-3.el8_8 and libreswan v4.9-4.el9_2
▶NVDlibreswan/libreswan4.9-1.el8, 4.9-1.el9+1

Also affects: Enterprise Linux 8.0, 9.0, 8.8, 9.2

🔴Vulnerability Details

3
GHSA
GHSA-gcrh-c42h-m2vw: A vulnerability was found in the libreswan library↗2023-05-18
▶
OSV
CVE-2023-2295: A vulnerability was found in the libreswan library↗2023-05-17
▶
CVEList
CVE-2023-2295: A vulnerability was found in the libreswan library↗2023-05-17
▶

📋Vendor Advisories

1
Red Hat
libreswan: Regression of CVE-2023-30570 fixes in the Red Hat Enterprise Linux↗2023-05-09
▶
CVE-2023-2295 — Uncontrolled Resource Consumption | cvebase