Libreswan Restart Issue Under IKEv2 Retransmit Scenarios
CVE-2024-2357

6.5MEDIUM

Key Information:

Vendor

The Libreswan Project (www.libreswan.org)

Status
Libreswan
Vendor
CVE Published:
11 March 2024

What is CVE-2024-2357?

The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys (authby=secret) and the connection cannot find a matching configured secret. When such a connection is automatically added on startup using the auto= keyword, it can cause repeated crashes leading to a Denial of Service.

Affected Version(s)

libreswan 4.2 <= 4.12

libreswan 3.0

libreswan 5.0

References

https://libreswan.org/security/CVE-2024-2357
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-ann...
https://lists.fedoraproject.org/archives/list/package-ann...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrew Vaughn
.