Moderate: libreswan security update
Summary
ALSA-2023:7052: Moderate: libreswan security update. Affects libreswan versions < 4.12-2.el8. Fixed in 4.12-2.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).
Vulnerability Detail
The libreswan package is affected by multiple vulnerabilities:
- CVE-2023-38710: An invalid IKEv2 REKEY proposal can cause a restart.
- CVE-2023-38711: An invalid IKEv1 Quick Mode ID can cause a restart.
- CVE-2023-38712: An invalid IKEv1 repeat IKE SA delete can cause a crash and restart.
These vulnerabilities can be exploited by an attacker to disrupt the functionality of libreswan and potentially gain unauthorized access or cause denial of service.
How To Fix
Minimum fixed version
4.12-2.el8
This is the first release that contains the fix.
sudo dnf update libreswanTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
Updating the libreswan package to version 4.12-2.el8 or later is crucial to address the identified vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libreswan →
FAQ
Libreswan is an implementation of IPsec and IKE for Linux, providing authentication and encryption services for secure tunnels.
IPsec is the Internet Protocol Security, which uses strong cryptography to secure network communications.
IKE (Internet Key Exchange) is a protocol used to establish security associations in IPsec.
These vulnerabilities can lead to service disruptions, unauthorized access, or denial of service.
You can update the libreswan package by following the instructions provided by your Linux distribution or package manager.
Related vulnerabilities
Recent vulnerabilities recorded for libreswan.
