Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Mageia: 2022-0030 Moderate: Libreswan Denial Of Service Update

mageia
Calendar Grey January 25, 2022
Dist Mageia Esm H88
The update from Libreswan 4.2 to 4.5 addresses a denial-of-service vulnerability highlighted in Mageia advisory 2022-0030. This flaw can be leveraged by remote adversaries to initiate crashes.
Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly ...

Summary

Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. (CVE-2022-23094)

References

- https://bugs.mageia.org/show_bug.cgi?id=29900

- https://nvd.nist.gov/vuln/detail/CVE-2022-23094

- https://libreswan.org/security/CVE-2022-23094/CVE-2022-23094.txt

- https://lists.debian.org/debian-security-announce/2022/msg00014.html

- https://www.cve.org/CVERecord?id=CVE-2022-23094

Topics%20covered

Topics Covered

security advisory denial of service security issue software update DoS libreswan Mageia

Resolution

SRPMS

- 8/core/libreswan-4.6-4.mga8

Publication date: 25 Jan 2022
URL: https://advisories.mageia.org/MGASA-2022-0030.html
Type: security
CVE: CVE-2022-23094

Topics%20covered

Topics Covered

security advisory denial of service security issue software update DoS libreswan Mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here