CVE-2023-2295
A vulnerability was found in the libreswan library.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.58%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote code execution is possible. This CVE exists because of a CVE-2023-30570 security regression for libreswan package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.58% probability · 74th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400
- Affected
- libreswan/libreswan · redhat/enterprise linux · redhat/enterprise linux eus · redhat/enterprise linux server aus · redhat/enterprise linux server tus
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2023:3107Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:3148Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2023-2295Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2189777Issue Tracking
- https://access.redhat.com/errata/RHSA-2023:3107Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:3148Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2023-2295Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2189777Issue Tracking
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.