Libreswan
By the Year
In 2024 there have been 0 vulnerabilities in Libreswan . Last year Libreswan had 6 security vulnerabilities published. Right now, Libreswan is on track to have less security vulnerabilities in 2024 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 6 | 6.83 |
| 2022 | 1 | 7.50 |
| 2021 | 0 | 0.00 |
| 2020 | 1 | 7.50 |
| 2019 | 2 | 5.30 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Libreswan vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Libreswan Security Vulnerabilities
An issue was discovered in Libreswan 3.x and 4.x before 4.12
CVE-2023-38712
6.5 - Medium
- August 25, 2023
An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the deleted state causes the pluto daemon to crash and restart.
NULL Pointer Dereference
An issue was discovered in Libreswan before 4.12
CVE-2023-38711
6.5 - Medium
- August 25, 2023
An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN, a NULL pointer dereference causes a crash and restart of the pluto daemon. NOTE: the earliest affected version is 4.6.
NULL Pointer Dereference
An issue was discovered in Libreswan before 4.12
CVE-2023-38710
6.5 - Medium
- August 25, 2023
An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent back. The notify payload's protocol ID is copied from the incoming packet, but the code that verifies outgoing packets fails an assertion that the protocol ID must be ESP (2) or AH(3) and causes the pluto daemon to crash and restart. NOTE: the earliest affected version is 3.20.
pluto in Libreswan before 4.11
CVE-2023-30570
7.5 - High
- May 29, 2023
pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The earliest affected version is 3.28.
Resource Exhaustion
A vulnerability was found in the libreswan library
CVE-2023-2295
7.5 - High
- May 17, 2023
A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote code execution is possible. This CVE exists because of a CVE-2023-30570 security regression for libreswan package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart)
CVE-2023-23009
6.5 - Medium
- February 21, 2023
Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length.
Resource Exhaustion
Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects
CVE-2022-23094
7.5 - High
- January 15, 2022
Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. This is fixed in 4.6.
NULL Pointer Dereference
An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan
CVE-2020-1763
7.5 - High
- May 12, 2020
An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.
Out-of-bounds Read
The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets
CVE-2019-10155
3.1 - Low
- June 12, 2019
The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.
Improper Input Validation
In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart
CVE-2019-12312
7.5 - High
- May 24, 2019
In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.
NULL Pointer Dereference
libreswan before 3.18
CVE-2016-5391
7.5 - High
- June 13, 2017
libreswan before 3.18 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto daemon restart).
NULL Pointer Dereference
The pluto IKE daemon in libreswan before 3.15 and Openswan before 2.6.45, when built with NSS
CVE-2015-3240
- November 09, 2015
The pluto IKE daemon in libreswan before 3.15 and Openswan before 2.6.45, when built with NSS, allows remote attackers to cause a denial of service (assertion failure and daemon restart) via a zero DH g^x value in a KE payload in a IKE packet.
Numeric Errors
libreswan 3.9 through 3.12
CVE-2015-3204
- July 01, 2015
libreswan 3.9 through 3.12 allows remote attackers to cause a denial of service (daemon restart) via an IKEv1 packet with (1) unassigned bits set in the IPSEC DOI value or (2) the next payload value set to ISAKMP_NEXT_SAK.
Improper Input Validation
