Published: 12/05/2020 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.

Vulnerable Product	Search on Vulmon	Subscribe to Product
libreswan libreswan 3.5
libreswan libreswan

Debian Bug report logs - #960458 libreswan: CVE-2020-1763 Package: src:libreswan; Maintainer for src:libreswan is Daniel Kahn Gillmor <dkg@fifthhorsemannet>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 12 May 2020 19:39:01 UTC Severity: important Tags: patch, security, upstream Found in version ...

Synopsis Important: libreswan security update Type/Severity Security Advisory: Important Topic An update for libreswan is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base sc ...

Synopsis Important: libreswan security update Type/Severity Security Advisory: Important Topic An update for libreswan is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnera ...

Synopsis Important: libreswan security update Type/Severity Security Advisory: Important Topic An update for libreswan is now available for Red Hat Enterprise Linux 81 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Sco ...

Stephan Zeisberg discovered that the libreswan IPsec implementation could be forced into a crash/restart via a malformed IKEv1 Informational Exchange packet, resulting in denial of service For the stable distribution (buster), this problem has been fixed in version 327-6+deb10u1 We recommend that you upgrade your libreswan packages For the deta ...

CWE-125 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1763 https://github.com/libreswan/libreswan/commit/471a3e41a449d7c753bc4edbba4239501bb62ba8 https://bugzilla.redhat.com/show_bug.cgi?id=1813329 https://libreswan.org/security/CVE-2020-1763/CVE-2020-1763.txt https://www.debian.org/security/2020/dsa-4684 https://security.gentoo.org/glsa/202007-21 https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=960458 https://nvd.nist.gov https://www.debian.org/security/2020/dsa-4684

CVE-2020-1763

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect