Published: 17/05/2023 Updated: 25/05/2023

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 0

A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote code execution is possible. This CVE exists because of a CVE-2023-30570 security regression for libreswan package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Vulnerable Product	Search on Vulmon	Subscribe to Product
libreswan libreswan 4.9-1.el8
libreswan libreswan 4.9-1.el9
redhat enterprise linux 8.0
redhat enterprise linux 9.0
redhat enterprise linux server tus 8.8
redhat enterprise linux server aus 8.8
redhat enterprise linux eus 8.8
redhat enterprise linux server aus 9.2
redhat enterprise linux eus 9.2

Synopsis Important: libreswan security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for libreswan is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as havin ...

Synopsis Important: libreswan security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for libreswan is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as havin ...

Synopsis Important: OpenShift Container Platform 4132 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 4132 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift C ...

NVD-CWE-noinfo https://access.redhat.com/security/cve/CVE-2023-2295 https://bugzilla.redhat.com/show_bug.cgi?id=2189777 https://access.redhat.com/errata/RHSA-2023:3148 https://access.redhat.com/errata/RHSA-2023:3107 https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2023:3107

CVE-2023-2295

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect