Libreswan vulnerabilities
We track 3 vulnerabilities in Libreswan products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on May 29, 2023.
Latest Libreswan vulnerabilities
- 7.5 High severity
Libreswan: Uncontrolled Resource Consumption
pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The earliest affected version is 3.28.
- 7.5 High severity
libreswan: Uncontrolled Resource Consumption
A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is
- 7.5 High severity
Libreswan: NULL Pointer Dereference
Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. This is fixed in 4.6.