CVE-2022-23094: Null Pointer Dereference
Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. This is fixed in 4.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libreswanto a version that resolves this vulnerability.Fixed in 4.10-2+deb12u1Fixed in 5.2-2.2Fixed in 5.2-2.5 - Upgrade
Upgrade
alpine/libreswanto a version that resolves this vulnerability.Fixed in 4.6-r0 - Upgrade
Upgrade
debian/libreswanto a version that resolves this vulnerability.Fixed in 4.6-1 - Upgrade
Upgrade
Libreswanto a version that resolves this vulnerability.Fixed in 4.6
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2022-23094.
What is the severity of CVE-2022-23094?
The severity of CVE-2022-23094 is high with a severity value of 7.5.
How does CVE-2022-23094 affect Libreswan?
CVE-2022-23094 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) in Libreswan versions 4.2 through 4.5.
How can I fix CVE-2022-23094?
You can fix CVE-2022-23094 by updating to Libreswan version 4.6 or applying the patch provided by the vendor.
Where can I find more information about CVE-2022-23094?
You can find more information about CVE-2022-23094 at the following references: [link1], [link2], [link3].