CVE-2023-2295

Name of the Vulnerable Software and Affected Versions libreswan (affected versions not specified)

Description A security issue was found in the libreswan library. This occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote code execution is possible. This issue exists due to a security regression in the libreswan package.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.