NULL Pointer Dereference Affecting libreswan package, versions <0:4.12-1.el9


Severity

Recommended
0.0
medium
0
10

Based on CentOS security rating.

Threat Intelligence

EPSS
0.07% (32nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about NULL Pointer Dereference vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-CENTOS9-LIBRESWAN-5831249
  • published9 Aug 2023
  • disclosed8 Aug 2023

Introduced: 8 Aug 2023

CVE-2023-38711  (opens in a new tab)
CWE-476  (opens in a new tab)

How to fix?

Upgrade Centos:9 libreswan to version 0:4.12-1.el9 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libreswan package and not the libreswan package as distributed by Centos. See How to fix? for Centos:9 relevant fixed versions and status.

An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN, a NULL pointer dereference causes a crash and restart of the pluto daemon. NOTE: the earliest affected version is 4.6.

CVSS Scores

version 3.1