Bug 2189777 (CVE-2023-2295) - CVE-2023-2295 libreswan: Regression of CVE-2023-30570 fixes in the Red Hat Enterprise Linux
Summary: CVE-2023-2295 libreswan: Regression of CVE-2023-30570 fixes in the Red Hat En...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2023-2295
Deadline: 2023-05-09
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Sahana Prasad
QA Contact:
URL:
Whiteboard:
Depends On: 2190147 2190148
Blocks: 2187158
TreeView+ depends on / blocked
 
Reported: 2023-04-26 06:34 UTC by TEJ RATHI
Modified: 2023-05-17 07:42 UTC (History)
3 users (show)

Fixed In Version: libreswan 4.9-3.el8_8, libreswan 4.9-4.el9_2
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote code execution is possible. This CVE exists because of a CVE-2023-30570 security regression for libreswan package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
Clone Of:
Environment:
Last Closed: 2023-05-17 07:42:06 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:3107 0 None None None 2023-05-16 10:45:38 UTC
Red Hat Product Errata RHSA-2023:3148 0 None None None 2023-05-16 19:38:22 UTC

Description TEJ RATHI 2023-04-26 06:34:48 UTC
The libreswan flaw CVE-2023-30570 (bug 2187165) was addressed in Red Hat Enterprise Linux 8 via erratum RHSA-2023:2122 and in Red Hat Enterprise Linux 9 via erratum RHSA-2023:2120, released on May 04, 2023:

https://access.redhat.com/errata/RHSA-2023:2122
https://access.redhat.com/errata/RHSA-2023:2120

However, the fix for this issue was not included in the libreswan updates released as part of Red Hat Enterprise Linux 8.8 GA erratum (RHBA-2023:2865) and Red Hat Enterprise Linux 9.2 GA erratum (RHBA-2023:2355), causing a security regression of previously released fix. A new CVE-ID CVE-2023-2295 was assigned for this security regression.

Note that this issue and CVE-ID is specific to the libreswan packages as shipped with Red Hat Enterprise Linux and is not applicable to any upstream libreswan version or libreswan packages of any other vendor that are not directly based on Red Hat Enterprise Linux packages.

For more information about the original flaw, refer to the CVE page or bug linked above.

Comment 6 errata-xmlrpc 2023-05-16 10:45:37 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:3107 https://access.redhat.com/errata/RHSA-2023:3107

Comment 7 errata-xmlrpc 2023-05-16 19:38:21 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:3148 https://access.redhat.com/errata/RHSA-2023:3148

Comment 8 Product Security DevOps Team 2023-05-17 07:42:04 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-2295


Note You need to log in before you can comment on or make changes to this bug.