CVE-2020-1763

High

Description

An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.

SeverityHigh

CVSS7.5

Exploit probability—

ProductLibreswan

PublishedMay 12, 2020

First seenMay 12, 2020

Weakness typeCWE-125Out-of-bounds read

How to fix

Vendor advisories

debian.org/security/2020/dsa-4684
security.gentoo.org/glsa/202007-21

Affected products

Product	Affected versions	Fixed in
libreswan libreswan	3.27 ≤ v ≤ 3.31, 3.5	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.