Bug 1714141 (CVE-2019-10155)

Summary:	CVE-2019-10155 libreswan: vulnerability in the processing of IKEv1 informational packets due to missing integrity check
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	avagarwa, code, mikhail.zabaluev, pwouters, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libreswan 3.29	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in the Libreswan Project. It was discovered that libreswan, strongswan, and openswan did not verify the integrity check value for received IKEv1 Informational Exchange packets.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-11-06 00:52:44 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1719334, 1719335, 1738853
Bug Blocks:	1714144

Description Marian Rehak 2019-05-27 08:41:52 UTC

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified.

Bugzilla issue:

https://bugzilla.redhat.com/show_bug.cgi?id=1713512

Comment 1 Marian Rehak 2019-05-27 08:45:52 UTC

Acknowledgments:

Name: team (Libreswan Project)

Comment 3 Marian Rehak 2019-06-05 07:07:40 UTC

External References:

https://libreswan.org/security/CVE-2019-10155/

Comment 4 Dhananjay Arunesh 2019-06-11 14:15:54 UTC

Upstream Patch:
https://libreswan.org/security/CVE-2019-10155/CVE-2019-10155.patch

Comment 5 Dhananjay Arunesh 2019-06-11 14:18:11 UTC

Created libreswan tracking bugs for this issue:

Affects: epel-6 [bug 1719334]

Comment 6 Dhananjay Arunesh 2019-06-11 14:19:16 UTC

Created libreswan tracking bugs for this issue:

Affects: fedora-all [bug 1719335]

Comment 8 Paul Wouters 2019-06-11 15:08:00 UTC

note: fedora versions were already in updates-testing before this bug was created (see rhbz#1718986)

Comment 10 msiddiqu 2019-08-06 14:07:10 UTC

Reference: 

https://libreswan.org/security/CVE-2019-10155/

Comment 12 Stefan Cornelius 2019-08-08 09:51:53 UTC

Mitigation:

If all IKE peers support IKEv2, it is possible to reconfigure IKEv1 connections to use IKEv2 via the "ikev2=insist" keyword.

Comment 13 errata-xmlrpc 2019-11-05 20:44:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:3391 https://access.redhat.com/errata/RHSA-2019:3391

Comment 14 Product Security DevOps Team 2019-11-06 00:52:44 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-10155