Vulnerability · Published May 12, 2020 · Assigned by redhat
CVE-2020-1763
High 7.5
In plain English
A high-severity out-of-bounds read in libreswan from the libreswan Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)3.6%top 10.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | libreswan | 3.32-r0 | ALPINE-CVE-2020-1763 |
| Alpine:v3.21 | libreswan | 3.32-r0 | ALPINE-CVE-2020-1763 |
| Alpine:v3.22 | libreswan | 3.32-r0 | ALPINE-CVE-2020-1763 |
| Alpine:v3.23 | libreswan | 3.32-r0 | ALPINE-CVE-2020-1763 |
| Alpine:v3.24 | libreswan | 3.32-r0 | ALPINE-CVE-2020-1763 |
| Debian:12 | libreswan | 3.32-1 | DEBIAN-CVE-2020-1763 |
| Debian:13 | libreswan | 3.32-1 | DEBIAN-CVE-2020-1763 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| the libreswan Project | libreswan | from versions 3.27 till 3.31 |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://libreswan.org/security/CVE-2020-1763/CVE-2020-1763.txt x_refsource_CONFIRM
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1763 x_refsource_CONFIRM
- https://bugzilla.redhat.com/show_bug.cgi?id=1813329 x_refsource_MISC
- https://github.com/libreswan/libreswan/commit/471a3e41a449d7c753bc4edbba4239501bb62ba8 x_refsource_CONFIRM
- DSA-4684 vendor-advisory, x_refsource_DEBIAN
- GLSA-202007-21 vendor-advisory, x_refsource_GENTOO
- https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf x_refsource_CONFIRM
- https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04 x_refsource_MISC