CVE-2022-23094
Fixed in a distro release EPSS 3%
Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. This is fixed in 4.6.
Products: libreswan, fedoraproject fedora, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | libreswan | 4.4-4.el8_5 |
| Debian 11 | libreswan | 4.3-1+deb11u1 |
| Debian 12 | libreswan | 4.6-1 |
| Debian 13 | libreswan | 4.6-1 |
| Debian 14 | libreswan | 4.6-1 |
| Red Hat Enterprise Linux 8 | libreswan | 0:4.4-4.el8_5 |
| Red Hat Enterprise Linux 8 | libreswan-debuginfo | 0:4.4-4.el8_5 |
| Red Hat Enterprise Linux 8 | libreswan-debugsource | 0:4.4-4.el8_5 |
| Red Hat rhel eus 8.4 | libreswan | 0:4.3-6.el8_4 |
| Red Hat rhel eus 8.4 | libreswan-debuginfo | 0:4.3-6.el8_4 |
| Red Hat rhel eus 8.4 | libreswan-debugsource | 0:4.3-6.el8_4 |
| Rocky Linux 8 | libreswan | 0:4.4-4.el8_5 |
| Ubuntu 18.04 LTS | libreswan | no fix |
| Ubuntu 20.04 LTS | libreswan | no fix |
| Ubuntu 22.04 LTS | libreswan | no fix |