Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux Libreswan can crash from malformed network data
published 3 years ago
Summary
The Libreswan VPN component on AlmaLinux may stop working if it receives specially crafted traffic with incorrect length information. This could disrupt VPN connections and potentially allow a denial‑of‑service attack. Update Libreswan to the latest version to fix the issue and also resolve a configuration problem with RSA signatures under strict security policies.
What to do
- Update almalinux libreswan to version 4.9-2.el8_8.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | libreswan |
< 4.9-2.el8_8.2 Fix: upgrade to 4.9-2.el8_8.2
|
Original advisory text
Moderate: libreswan security and bug fix update
Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).
Security Fix(es):
* libreswan: remote DoS via crafted TS payload with an incorrect selector length (CVE-2023-23009)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* authby=rsasig fails in FIPS policy (BZ#2187647)
Security Fix(es):
* libreswan: remote DoS via crafted TS payload with an incorrect selector length (CVE-2023-23009)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* authby=rsasig fails in FIPS policy (BZ#2187647)
References
- https://access.redhat.com/errata/RHSA-2023:3095 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-23009 Third Party Advisory
- https://bugzilla.redhat.com/2173610 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2023-3095.html Vendor Advisory
Timeline
Published16 May 2023
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2023:3095 · OSV
Track software like this
Free during beta