| Summary: | libreswan new security issue CVE-2022-23094 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | andrewsfarm, davidwhodgins, herman.viaene, smelror, sysadmin-bugs |
| Version: | 8 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA8-64-OK | ||
| Source RPM: | libreswan-4.5-1.mga9.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2022-01-17 17:48:06 CET
David Walser
2022-01-17 17:48:19 CET
Whiteboard:
(none) =>
MGA8TOO This is good for assigning to the active maintainer, Stig Assignee:
bugsquad =>
smelror Advisory ======== Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. References ========== https://nvd.nist.gov/vuln/detail/CVE-2022-23094 https://libreswan.org/security/CVE-2022-23094/CVE-2022-23094.txt https://www.debian.org/security/2022/dsa-5048 Files ===== Uploaded to core/updates_testing libreswan-4.6-1.mga8 from libreswan-4.6-1.mga8.src.rpm Version:
Cauldron =>
8
David Walser
2022-01-18 00:00:16 CET
CC:
(none) =>
smelror Update rejected by build system, looks like a build system problem. Version:
8 =>
Cauldron And packaging error: - libreswan-4.6-1.mga8.i586: - non-ghost-in-run /run/pluto permission issues fixed on buildsystem And I see another thing that dos not look right... http://svnweb.mageia.org/packages?view=revision&revision=1768884 Here you removed the use of tmpfiles, which means /run/pluto wont be available after install or reboot of system... Thanks for spotting that, Thomas. Fixed in 4.6-3. Also thanks to Thierry for spotting a wrong requires. Will update the advisory soon. Advisory ======== Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. References ========== https://nvd.nist.gov/vuln/detail/CVE-2022-23094 https://libreswan.org/security/CVE-2022-23094/CVE-2022-23094.txt https://www.debian.org/security/2022/dsa-5048 Files ===== Uploaded to core/updates_testing libreswan-4.6-2.mga8 from libreswan-4.6-2.mga8.src.rpm Assignee:
smelror =>
qa-bugs Advisory ======== Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. References ========== https://nvd.nist.gov/vuln/detail/CVE-2022-23094 https://libreswan.org/security/CVE-2022-23094/CVE-2022-23094.txt https://www.debian.org/security/2022/dsa-5048 Files ===== Uploaded to core/updates_testing libreswan-4.6-3.mga8 from libreswan-4.6-3.mga8.src.rpm A requested package cannot be installed: libreswan-4.6-3.mga8.x86_64 (due to unsatisfied unbound-libs[>= 1.6.6]) Keywords:
(none) =>
feedback Indeed, we don't hardcode library requires, as those are autogenerated. Not all Fedora packagers have figured that out yet, so be careful copying from them. Advisory ======== Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. References ========== https://nvd.nist.gov/vuln/detail/CVE-2022-23094 https://libreswan.org/security/CVE-2022-23094/CVE-2022-23094.txt https://www.debian.org/security/2022/dsa-5048 Files ===== Uploaded to core/updates_testing libreswan-4.6-4.mga8 from libreswan-4.6-4.mga8.src.rpm
Dave Hodgins
2022-01-19 17:11:09 CET
Keywords:
feedback =>
(none) MGA8-64 Plasma on Lenovo B50 in Dutch No installation issues. Ref bug 25065, no ill effects on my own LAN with own DNS server and NFS-shares. OK for me. CC:
(none) =>
herman.viaene
Dave Hodgins
2022-01-24 23:05:03 CET
Keywords:
(none) =>
advisory An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0030.html Status:
NEW =>
RESOLVED |