High severity · published May 17, 2023
CVE-2023-2295
A vulnerability was found in the libreswan library
7.5
CVSS
1.6%
EPSS
No
On KEV
Description
A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote code execution is possible. This CVE exists because of a CVE-2023-30570 security regression for libreswan package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux · Redhat
8.0; 9.0 · source: NVD
EL
Enterprise Linux Eus · Redhat
8.8; 9.2 · source: NVD
EL
Enterprise Linux Server Aus · Redhat
8.8; 9.2 · source: NVD
EL
Enterprise Linux Server Tus · Redhat
8.8 · source: NVD
LI
Libreswan · Libreswan
4.9-1.el8; 4.9-1.el9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-2295
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-2295
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:3107
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:3148
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-2295
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2189777
More from Libreswan
7.5
CVE-2026-12413
IKEv2 Denial of Service via malformed fragmentation
7.5
CVE-2023-30570
pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets
7.5
CVE-2022-23094
Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly…
7.5
CVE-2020-1763
An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan…
7.5
CVE-2019-12312
In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart