CVE-2023-38711

Name of the Vulnerable Software and Affected Versions Libreswan versions prior to 4.12

Description An issue was discovered in Libreswan when an IKEv1 Quick Mode connection configured with ID IPV4 ADDR or ID IPV6 ADDR receives an IDcr payload with ID FQDN, causing a NULL pointer dereference. This results in a crash and restart of the pluto daemon, potentially allowing a remote attacker to perform a denial-of-service attack.

Recommendations For versions prior to 4.12, update to version 4.12 or later to resolve the issue. As a temporary workaround, consider restricting the use of IKEv1 Quick Mode connections with ID IPV4 ADDR or ID IPV6 ADDR to minimize the risk of exploitation.