Debian has issued an advisory on January 15: https://www.debian.org/security/2022/dsa-5048 The issue is fixed upstream in 4.6: https://libreswan.org/security/CVE-2022-23094/CVE-2022-23094.txt Mageia 8 is also affected.
Whiteboard: (none) => MGA8TOOStatus comment: (none) => Fixed upstream in 4.6
This is good for assigning to the active maintainer, Stig
Assignee: bugsquad => smelror
Advisory ======== Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. References ========== https://nvd.nist.gov/vuln/detail/CVE-2022-23094 https://libreswan.org/security/CVE-2022-23094/CVE-2022-23094.txt https://www.debian.org/security/2022/dsa-5048 Files ===== Uploaded to core/updates_testing libreswan-4.6-1.mga8 from libreswan-4.6-1.mga8.src.rpm
Version: Cauldron => 8Assignee: smelror => qa-bugsWhiteboard: MGA8TOO => (none)
CC: (none) => smelrorStatus comment: Fixed upstream in 4.6 => (none)
Update rejected by build system, looks like a build system problem.
Version: 8 => CauldronCC: (none) => sysadmin-bugsWhiteboard: (none) => MGA8TOOAssignee: qa-bugs => smelror
And packaging error: - libreswan-4.6-1.mga8.i586: - non-ghost-in-run /run/pluto permission issues fixed on buildsystem
And I see another thing that dos not look right... http://svnweb.mageia.org/packages?view=revision&revision=1768884 Here you removed the use of tmpfiles, which means /run/pluto wont be available after install or reboot of system...
Thanks for spotting that, Thomas. Fixed in 4.6-3. Also thanks to Thierry for spotting a wrong requires. Will update the advisory soon.
Advisory ======== Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. References ========== https://nvd.nist.gov/vuln/detail/CVE-2022-23094 https://libreswan.org/security/CVE-2022-23094/CVE-2022-23094.txt https://www.debian.org/security/2022/dsa-5048 Files ===== Uploaded to core/updates_testing libreswan-4.6-2.mga8 from libreswan-4.6-2.mga8.src.rpm
Assignee: smelror => qa-bugsWhiteboard: MGA8TOO => (none)Version: Cauldron => 8
Advisory ======== Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. References ========== https://nvd.nist.gov/vuln/detail/CVE-2022-23094 https://libreswan.org/security/CVE-2022-23094/CVE-2022-23094.txt https://www.debian.org/security/2022/dsa-5048 Files ===== Uploaded to core/updates_testing libreswan-4.6-3.mga8 from libreswan-4.6-3.mga8.src.rpm
A requested package cannot be installed: libreswan-4.6-3.mga8.x86_64 (due to unsatisfied unbound-libs[>= 1.6.6])
Keywords: (none) => feedbackCC: (none) => davidwhodgins
Indeed, we don't hardcode library requires, as those are autogenerated. Not all Fedora packagers have figured that out yet, so be careful copying from them.
Advisory ======== Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. References ========== https://nvd.nist.gov/vuln/detail/CVE-2022-23094 https://libreswan.org/security/CVE-2022-23094/CVE-2022-23094.txt https://www.debian.org/security/2022/dsa-5048 Files ===== Uploaded to core/updates_testing libreswan-4.6-4.mga8 from libreswan-4.6-4.mga8.src.rpm
Keywords: feedback => (none)
MGA8-64 Plasma on Lenovo B50 in Dutch No installation issues. Ref bug 25065, no ill effects on my own LAN with own DNS server and NFS-shares. OK for me.
CC: (none) => herman.viaeneWhiteboard: (none) => MGA8-64-OK
Validating. Advisory in Comment 11.
Keywords: (none) => validated_updateCC: (none) => andrewsfarm
Keywords: (none) => advisory
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0030.html
Status: NEW => RESOLVEDResolution: (none) => FIXED