CVE-2024-2357

2024-03-1120:15:07

d42dc95b-23f1-4e06-9076-20753a0fb0df

web.nvd.nist.gov

libreswan project

cve-2024-2357

dos

ikev2

nvd

presharedkeys

authby=secret

6.1 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.3%

JSON

The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys (authby=secret) and the connection cannot find a matching configured secret. When such a connection is automatically added on startup using the auto= keyword, it can cause repeated crashes leading to a Denial of Service.

CNA Affected

[
  {
    "vendor": "The Libreswan Project (www.libreswan.org)",
    "product": "libreswan",
    "versions": [
      {
        "version": "3.0",
        "status": "unaffected",
        "lessThanOrEqual": "4.1",
        "versionType": "semver"
      },
      {
        "version": "4.2",
        "status": "affected",
        "lessThanOrEqual": "4.12",
        "versionType": "semver"
      },
      {
        "version": "5.0",
        "status": "unaffected"
      }
    ],
    "defaultStatus": "unaffected"
  }
]