Libreswan 4.2 through 4.5 allows remote attackers to...
High severity
Unreviewed
Published
Jan 16, 2022
to the GitHub Advisory Database
•
Updated Feb 3, 2023
Description
Published by the National Vulnerability Database
Jan 15, 2022
Published to the GitHub Advisory Database
Jan 16, 2022
Last updated
Feb 3, 2023
Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. This is fixed in 4.6.
References