Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the libreswan-4.9-4.el9 build changelog.

  - remote DoS via crafted TS payload with an incorrect selector length (rhbz#2173674) (CVE-2023-23009)

  - pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via     unauthenticated IKEv1 Aggressive Mode packets. The earliest affected version is 3.28. (CVE-2023-30570)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-3095 advisory.

  - Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via     crafted TS payload with an incorrect selector length. (CVE-2023-23009)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2023:3095 advisory.

  - Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via     crafted TS payload with an incorrect selector length. (CVE-2023-23009)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-2633 advisory.

  - Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via     crafted TS payload with an incorrect selector length. (CVE-2023-23009)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:3095 advisory.

  - libreswan: remote DoS via crafted TS payload with an incorrect selector length (CVE-2023-23009)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2023:2633 advisory.

  - Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via     crafted TS payload with an incorrect selector length. (CVE-2023-23009)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:2633 advisory.

  - libreswan: remote DoS via crafted TS payload with an incorrect selector length (CVE-2023-23009)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-42ec148952 advisory.

  - Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via     crafted TS payload with an incorrect selector length. (CVE-2023-23009)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-a2348480cb advisory.

  - Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via     crafted TS payload with an incorrect selector length. (CVE-2023-23009)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-5368 advisory.

  - Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via     crafted TS payload with an incorrect selector length. (CVE-2023-23009)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
191415	CentOS 9 : libreswan-4.9-4.el9	Nessus	CentOS Local Security Checks	high
176344	Oracle Linux 8 : libreswan (ELSA-2023-3095)	Nessus	Oracle Linux Local Security Checks	medium
176129	AlmaLinux 8 : libreswan (ALSA-2023:3095)	Nessus	Alma Linux Local Security Checks	medium
175987	Oracle Linux 9 : libreswan (ELSA-2023-2633)	Nessus	Oracle Linux Local Security Checks	medium
175846	RHEL 8 : libreswan (RHSA-2023:3095)	Nessus	Red Hat Local Security Checks	medium
175643	AlmaLinux 9 : libreswan (ALSA-2023:2633)	Nessus	Alma Linux Local Security Checks	medium
175401	RHEL 9 : libreswan (RHSA-2023:2633)	Nessus	Red Hat Local Security Checks	medium
174665	Fedora 37 : libreswan (2023-42ec148952)	Nessus	Fedora Local Security Checks	medium
174633	Fedora 38 : libreswan (2023-a2348480cb)	Nessus	Fedora Local Security Checks	medium
172090	Debian DSA-5368-1 : libreswan - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2023-23009

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium