Log in Start free

Vulnerability · Published Mar 11, 2024 · Assigned by libreswan

CVE-2024-2357IKEv2 misconfiguration can cause libreswan to abort and restart

Medium 6.5

In plain English

A medium-severity security flaw in libreswan from The Libreswan Project (www.libreswan.org). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.0%top 38.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys (authby=secret) and the connection cannot find a matching configured secret. When such a connection is automatically added on startup using the auto= keyword, it can cause repeated crashes leading to a Denial of Service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libreswan4.12-2.el8_9.2.alma.1ALSA-2024:1998
AlmaLinux:9libreswan4.12-1.el9_3.1.alma.1ALSA-2024:2033
AlmaLinux:9libreswan4.12-2.el9_4.alma.1ALSA-2024:2565
Alpine:v3.20libreswan4.15-r0ALPINE-CVE-2024-2357
Alpine:v3.21libreswan4.15-r0ALPINE-CVE-2024-2357
Alpine:v3.22libreswan4.15-r0ALPINE-CVE-2024-2357
Alpine:v3.23libreswan4.15-r0ALPINE-CVE-2024-2357
Alpine:v3.24libreswan4.15-r0ALPINE-CVE-2024-2357
Debian:12libreswanno fix listedDEBIAN-CVE-2024-2357
Debian:13libreswan4.14-1DEBIAN-CVE-2024-2357
Rocky Linux:8libreswan0:4.12-2.el8_9.2RLSA-2024:1998
Rocky Linux:9libreswan0:4.12-2.el9_4RLSA-2024:2565
Ubuntu:22.04:LTSlibreswanno fix listedUBUNTU-CVE-2024-2357
Ubuntu:24.04:LTSlibreswanno fix listedUBUNTU-CVE-2024-2357

Affected products (as reported)

VendorProductVersions
The Libreswan Project (www.libreswan.org) libreswan 4.2 – through 4.12

References