Back to CVE Browser

CVE-2019-12312

HIGH

7.5

CVSS Severity Score

EPSS Score0.1540%

EPSS Percentile12.94th

PublishedMay 24, 2019

Last ModifiedNov 21, 2024

Vulnerability Description

In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.

Affected Platforms (CPE)

📦

Libreswan

Libreswan

< 3.28

References & Advisories

🔗 http://www.iwantacve.cn/index.php/archives/218/

🔗 https://github.com/libreswan/libreswan/compare/9b1394e...3897683

🔗 https://github.com/libreswan/libreswan/issues/246

🔗 https://libreswan.org/security/CVE-2019-12312/CVE-2019-12312.txt

🔗 https://libreswan.org/security/CVE-2019-12312/libreswan-3.27-CVE-2019-12312.patch

🔗 http://www.iwantacve.cn/index.php/archives/218/

🔗 https://github.com/libreswan/libreswan/compare/9b1394e...3897683

🔗 https://github.com/libreswan/libreswan/issues/246

Related Vulnerabilities

CVE-2013-72839.3

Race condition in the libreswan.spec files for Red Hat Enterprise Linux (RHEL) and Fedora packages in libreswan 3.6 has unspecifie...

CVE-2016-30717.5

Libreswan 3.16 might allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes_xcbc transform.

CVE-2020-17637.5

An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticate...

CVE-2016-53617.5

programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a ...