Stay Secure with the Latest Linux Advisories

security advisorycriticaldaemon

Mageia 8 MGASA-2023-0089 Critical: Libreswan Traffic Selector Crash

A change in the libreswan 4.2 Traffic Selector parsing code introduced a missing check that would reject palformed Traffic Selector payloads. As such, in such case the code stumbles on to hit a double free, leading to a crash and restart of the pluto daemon. No remote code execution. (CVE-2023-23009) . MGASA-2023-0089 - Updated libreswan packages fix security vulnerability Publication date: 11 Mar 2023 URL: https://advisories.mageia.org/MGASA-2023-0089.html Type: security Affected Mageia releases: 8 CVE: CVE-2023-23009 A change in the libreswan 4.2 Traffic Selector parsing code introduced a missing check that would reject palformed Traffic Selector payloads. As such, in such case the code stumbles on to hit a double free, leading to a crash and restart of the pluto daemon. No remote code execution. (CVE-2023-23009) References: - https://bugs.mageia.org/show_bug.cgi?id=31636 - https://libreswan.org/security/CVE-2023-23009/CVE-2023-23009.txt - https://security-tracker.debian.org/tracker/CVE-2023-23009 - https://www.cve.org/CVERecord?id=CVE-2023-23009 SRPMS: - 8/core/libreswan-4.6-4.1.mga8 . StrongSwan security update fixes an application error that disrupts the swan daemon caused by improperly structured Configuration Selector data.. Libreswan, Traffic Selector, Mageia Security, Security Patch, Daemon Crash. . Severity: Critical. LinuxSecurity.com Team

Mar 11, 2023 •Critical Mageia