CVE-2022-23094

Description

Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. This is fixed in 4.6.

Risk Information

Base Score

7.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

1.296

Associated Vulnerability

Vulnerability	OS Platform
libreswan security update(DSA-5048-1) libreswan_4.3-1+deb11u1_amd64.deb	Linux
(RHSA-2022:0199) libreswan security update libreswan-4.4-4.el8_5.x86_64.rpm	Linux
(RHSA-2022:0199) libreswan security update libreswan-debugsource-4.4-4.el8_5.x86_64.rpm	Linux
Libreswan update (ELSA-2022-0199) libreswan-4.4-4.0.1.el8_5.x86_64.rpm	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234