Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:10594 advisory.

    Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and     uses strong cryptography to provide both authentication and encryption services. These services allow you     to build secure tunnels through untrusted networks such as virtual private network (VPN).

    Security Fix(es):

    * libreswan: remote DoS via crafted TS payload with an incorrect selector length (CVE-2023-23009)

    * libreswan: Invalid IKEv1 Quick Mode ID causes restart (CVE-2023-38711)

    * libreswan: Invalid IKEv2 REKEY proposal causes restart (CVE-2023-38710)

    * libreswan: Invalid IKEv1 repeat IKE SA delete causes crash and restart (CVE-2023-38712)

    * libreswan: Missing PreSharedKey for connection can cause crash (CVE-2024-2357)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the libreswan-4.9-4.el9 build changelog.

  - remote DoS via crafted TS payload with an incorrect selector length (rhbz#2173674) (CVE-2023-23009)

  - pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via     unauthenticated IKEv1 Aggressive Mode packets. The earliest affected version is 3.28. (CVE-2023-30570)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-3095 advisory.

    [4.9-2.0.1.2]
    - Add libreswan-oracle.patch to detect Oracle Linux distro

    [4.9-2.2]
    - Update libreswan-4.9-2176248-authby-rsasig.patch

    [4.9-2.1]
    - Resolves: rhbz#2187647 authby=rsasig fails in FIPS policy

    [4.9-2]
    - Fix CVE-2023-23009: remote DoS via crafted TS payload with an       incorrect selector length (rhbz#2186127)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2023:3095 advisory.

  - Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via     crafted TS payload with an incorrect selector length. (CVE-2023-23009)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-2633 advisory.

    [4.9-2.0.1]
    - Add libreswan-oracle.patch to detect Oracle Linux distro

    [4.9-2]
    - Fix CVE-2023-23009: remote DoS via crafted TS payload with an       incorrect selector length (rhbz#2173674)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:3095 advisory.

    Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and     uses strong cryptography to provide both authentication and encryption services. These services allow you     to build secure tunnels through untrusted networks such as virtual private network (VPN).

    Security Fix(es):

    * libreswan: remote DoS via crafted TS payload with an incorrect selector length (CVE-2023-23009)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * authby=rsasig fails in FIPS policy (BZ#2187647)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2023:2633 advisory.

  - Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via     crafted TS payload with an incorrect selector length. (CVE-2023-23009)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:2633 advisory.

    Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and     uses strong cryptography to provide both authentication and encryption services. These services allow you     to build secure tunnels through untrusted networks such as virtual private network (VPN).

    Security Fix(es):

    * libreswan: remote DoS via crafted TS payload with an incorrect selector length (CVE-2023-23009)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-42ec148952 advisory.

    Update to 4.10 for CVE-2023-23009

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-a2348480cb advisory.

    Update to 4.10 for CVE-2023-23009

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-5368 advisory.

  - Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via     crafted TS payload with an incorrect selector length. (CVE-2023-23009)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211987	RHEL 9 : libreswan (RHSA-2024:10594)	Nessus	Red Hat Local Security Checks	medium
191415	CentOS 9 : libreswan-4.9-4.el9	Nessus	CentOS Local Security Checks	high
176344	Oracle Linux 8 : libreswan (ELSA-2023-3095)	Nessus	Oracle Linux Local Security Checks	medium
176129	AlmaLinux 8 : libreswan (ALSA-2023:3095)	Nessus	Alma Linux Local Security Checks	medium
175987	Oracle Linux 9 : libreswan (ELSA-2023-2633)	Nessus	Oracle Linux Local Security Checks	medium
175846	RHEL 8 : libreswan (RHSA-2023:3095)	Nessus	Red Hat Local Security Checks	medium
175643	AlmaLinux 9 : libreswan (ALSA-2023:2633)	Nessus	Alma Linux Local Security Checks	medium
175401	RHEL 9 : libreswan (RHSA-2023:2633)	Nessus	Red Hat Local Security Checks	medium
174665	Fedora 37 : libreswan (2023-42ec148952)	Nessus	Fedora Local Security Checks	medium
174633	Fedora 38 : libreswan (2023-a2348480cb)	Nessus	Fedora Local Security Checks	medium
172090	Debian DSA-5368-1 : libreswan - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2023-23009

medium

Tenable Plugins

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium