REDHAT-BUG-2189777
First published: Wed Apr 26 2023(Updated: )
The libreswan flaw <a href="https://access.redhat.com/security/cve/CVE-2023-30570">CVE-2023-30570</a> (<a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED ERRATA - CVE-2023-30570 libreswan: Malicious IKEv1 Aggressive Mode packets can crash libreswan" href="show_bug.cgi?id=2187165">bug 2187165</a>) was addressed in Red Hat Enterprise Linux 8 via erratum RHSA-2023:2122 and in Red Hat Enterprise Linux 9 via erratum RHSA-2023:2120, released on May 04, 2023: <a href="https://access.redhat.com/errata/RHSA-2023:2122">https://access.redhat.com/errata/RHSA-2023:2122</a> <a href="https://access.redhat.com/errata/RHSA-2023:2120">https://access.redhat.com/errata/RHSA-2023:2120</a> However, the fix for this issue was not included in the libreswan updates released as part of Red Hat Enterprise Linux 8.8 GA erratum (RHBA-2023:2865) and Red Hat Enterprise Linux 9.2 GA erratum (RHBA-2023:2355), causing a security regression of previously released fix. A new CVE-ID <a href="https://access.redhat.com/security/cve/CVE-2023-2295">CVE-2023-2295</a> was assigned for this security regression. Note that this issue and CVE-ID is specific to the libreswan packages as shipped with Red Hat Enterprise Linux and is not applicable to any upstream libreswan version or libreswan packages of any other vendor that are not directly based on Red Hat Enterprise Linux packages. For more information about the original flaw, refer to the CVE page or bug linked above.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Enterprise Linux | <8.8 | |
| Red Hat Enterprise Linux | <9.2 | |
| Red Hat Libreswan |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2023-30570
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2187165
- https://access.redhat.com/errata/RHSA-2023:2122
- https://access.redhat.com/errata/RHSA-2023:2120
- https://access.redhat.com/security/cve/CVE-2023-2295
- https://access.redhat.com/errata/RHSA-2023:3107
- https://access.redhat.com/errata/RHSA-2023:3148
- https://access.redhat.com/security/cve/cve-2023-2295
- https://bugzilla.redhat.com/show_bug.cgi?id=2189777
- agent/last-modified-date
- agent/first-publish-date
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-2295
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat enterprise linux
- canonical/red hat libreswan