Resource Exhaustion Affecting libreswan package, versions <0:4.9-4.el9_2


Severity

Recommended
0.0
high
0
10

Based on CentOS security rating.

Threat Intelligence

EPSS
0.53% (78th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Resource Exhaustion vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-CENTOS9-LIBRESWAN-5497665
  • published5 May 2023
  • disclosed9 May 2023

Introduced: 5 May 2023

CVE-2023-2295  (opens in a new tab)
CWE-400  (opens in a new tab)

How to fix?

Upgrade Centos:9 libreswan to version 0:4.9-4.el9_2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libreswan package and not the libreswan package as distributed by Centos. See How to fix? for Centos:9 relevant fixed versions and status.

A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote code execution is possible. This CVE exists because of a CVE-2023-30570 security regression for libreswan package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

CVSS Scores

version 3.1