MGASA-2023-0089

See a problem?
Please try reporting it to the source first.

Source

https://advisories.mageia.org/MGASA-2023-0089.html

Import Source

https://advisories.mageia.org/MGASA-2023-0089.json

JSON Data

https://api.test.osv.dev/v1/vulns/MGASA-2023-0089

Related

CVE-2023-23009

Published

2023-03-11T19:00:39Z

Modified

2023-03-11T17:55:30Z

Summary

Updated libreswan packages fix security vulnerability

Details

A change in the libreswan 4.2 Traffic Selector parsing code introduced a missing check that would reject palformed Traffic Selector payloads. As such, in such case the code stumbles on to hit a double free, leading to a crash and restart of the pluto daemon. No remote code execution. (CVE-2023-23009)

References

Credits

- Mageia - COORDINATOR
- - https://wiki.mageia.org/en/Packages_Security_Team

Affected packages

Mageia:8 / libreswan

Package

Name: libreswan
Purl: pkg:rpm/mageia/libreswan?distro=mageia-8

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.6-4.1.mga8

Ecosystem specific

{
    "section": "core"
}