NULL Pointer Dereference Affecting libreswan package, versions <0:4.12-1.el9


Severity

Recommended
0.0
medium
0
10

Based on CentOS security rating.

Threat Intelligence

EPSS
0.07% (32nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about NULL Pointer Dereference vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-CENTOS9-LIBRESWAN-5831119
  • published9 Aug 2023
  • disclosed8 Aug 2023

Introduced: 8 Aug 2023

CVE-2023-38712  (opens in a new tab)
CWE-476  (opens in a new tab)

How to fix?

Upgrade Centos:9 libreswan to version 0:4.12-1.el9 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libreswan package and not the libreswan package as distributed by Centos. See How to fix? for Centos:9 relevant fixed versions and status.

An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the deleted state causes the pluto daemon to crash and restart.

CVSS Scores

version 3.1