Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia 8 MGASA-2023-0089 Critical: Libreswan Traffic Selector Crash

mageia
Calendar Grey March 11, 2023
Dist Mageia Esm H88
StrongSwan security update fixes an application error that disrupts the swan daemon caused by improperly structured Configuration Selector data.
A change in the libreswan 4.2 Traffic Selector parsing code introduced a missing check that would reject palformed Traffic Selector payloads

Summary

A change in the libreswan 4.2 Traffic Selector parsing code introduced a missing check that would reject palformed Traffic Selector payloads. As such, in such case the code stumbles on to hit a double free, leading to a crash and restart of the pluto daemon. No remote code execution. (CVE-2023-23009)

References

- https://bugs.mageia.org/show_bug.cgi?id=31636

- https://libreswan.org/security/CVE-2023-23009/CVE-2023-23009.txt

- https://security-tracker.debian.org/tracker/CVE-2023-23009

- https://www.cve.org/CVERecord?id=CVE-2023-23009

Topics%20covered

Topics Covered

security advisory critical daemon crash libreswan mageia traffic selector

Resolution

SRPMS

- 8/core/libreswan-4.6-4.1.mga8

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 11 Mar 2023
URL: https://advisories.mageia.org/MGASA-2023-0089.html
Type: security
CVE: CVE-2023-23009

Topics%20covered

Topics Covered

security advisory critical daemon crash libreswan mageia traffic selector

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here