Source: libreswan X-Debbugs-CC: [email protected] Severity: grave Tags: security
Hi, The following vulnerabilities were published for libreswan. CVE-2026-94453[0]: | Libreswan's pluto daemon has a use-after-free vulnerability when a | client connecting using IKE over TCP closes the connection and | another packet (retransmit or malicious) is received for the same | tuple. IKE state is retained in memory after the client closes the | connection, storing a pointer to iface_endpoint inside | ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the | daemon crashes and restarts. This vulnerability can be triggered | before the remote peer has authenticated itself. Continued | exploitation can lead to a denial of service. Remote code execution | could be possible. The IKE over TCP option is not enabled by | default; only configurations that contain listen-tcp=yes are | affected. https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt https://libreswan.org/security/CVE-2026-94453/ CVE-2026-77205[1]: | Libreswan in FIPS mode has a vulnerability where badly formed | received certificates are rejected, but not deleted from the NSS | cache. As a result, any real certificates with the same serial | number are rejected as well. This can be abused to lock out | legitimate peers from connecting. The add_decoded_cert() function | missed a call to CERT_DestroyCertificate() due to an incorrect fix | for CVE-2026-14957. Sending bogus certificates with new serial | numbers could prevent the real certificates with those serial | numbers from connecting until the service has restarted. https://libreswan.org/security/CVE-2026-77205/CVE-2026-77205.txt https://libreswan.org/security/CVE-2026-77205/ CVE-2026-77206[2]: | Libreswan's IKEv2 state machine has a null pointer dereference bug | in the EAP handling code for authentication. As a result of | inconsistency within the IKEv2 state machine code, this bug can be | triggered by any IKEv2 connection, even if EAP is not configured at | all. The error is caused by a fall-through where it incorrectly | dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH | packet can trigger this bug, meaning the peer does not need to be | authenticated. The bug results in a crash and restart of the pluto | daemon. No remote code execution is possible. Continued exploitation | can cause a denial of service. https://libreswan.org/security/CVE-2026-77206/CVE-2026-77206.txt https://libreswan.org/security/CVE-2026-77206/ CVE-2026-77207[3]: | Libreswan has a null pointer dereference bug in the PKCS#7 handling | code for IKE certificate authentication. When libreswan decodes an | IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the | PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates | the certificate list with SEC_PKCS7GetCertificateList(). The two NSS | APIs disagree on a SignedData that carries a CRL but no | certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a | CRL), so the guard passes, but GetCertificateList() returns NULL | (there are no certificates). This causes libreswan to dereference a | null pointer leading to a crash and restart. A malicious IKE_AUTH | packet can trigger this bug, meaning the peer does not need to be | authenticated. No remote code execution is possible. Continued | exploitation can cause a denial of service. https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt https://libreswan.org/security/CVE-2026-77207/ If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-94453 https://www.cve.org/CVERecord?id=CVE-2026-94453 [1] https://security-tracker.debian.org/tracker/CVE-2026-77205 https://www.cve.org/CVERecord?id=CVE-2026-77205 [2] https://security-tracker.debian.org/tracker/CVE-2026-77206 https://www.cve.org/CVERecord?id=CVE-2026-77206 [3] https://security-tracker.debian.org/tracker/CVE-2026-77207 https://www.cve.org/CVERecord?id=CVE-2026-77207 Please adjust the affected versions in the BTS as needed.
