CVE-2023-38711
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
An issue was discovered in Libreswan before version 4.12, occurring when an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN. This causes a NULL pointer dereference, resulting in a crash and restart of the pluto daemon.
Risk Assessment
Crashes of the pluto daemon may lead to service interruptions for VPN, affecting the availability and security of communications within the organization.
Recommendation
It is recommended to upgrade Libreswan to version 4.12 or later to mitigate this vulnerability.
Original NVD description (English source)
An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN, a NULL pointer dereference causes a crash and restart of the pluto daemon. NOTE: the earliest affected version is 4.6.