CVE-2019-10155 The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integr...
LowCVSS 3.1
EPSS 0.50%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libreswan(Debian:12) | < 3.27-6 | 3.27-6 |
| debian/libreswan(Debian:13) | < 3.27-6 | 3.27-6 |
| debian/strongswan(Debian:12) | < 5.1.0-1 | 5.1.0-1 |
| debian/strongswan(Debian:13) | < 5.1.0-1 | 5.1.0-1 |
| debian/strongswan(Debian:14) | < 5.1.0-1 | 5.1.0-1 |
| libreswan | < 3.29 | 3.29 |
| strongSwan | < 5.0.0 | 5.0.0 |
| xelerance openswan | All versions | No fix listed |
| fedoraproject fedora | = 29 | No fix listed |
| fedoraproject fedora | = 30 | No fix listed |
| redhat enterprise linux | = 8.0 | No fix listed |
| alpine/libreswan(Alpine:v3.11) | < 3.29-r0 | 3.29-r0 |
| alpine/libreswan(Alpine:v3.12) | < 3.29-r0 | 3.29-r0 |
| alpine/libreswan(Alpine:v3.13) | < 3.29-r0 | 3.29-r0 |
| alpine/libreswan(Alpine:v3.14) | < 3.29-r0 | 3.29-r0 |
| alpine/libreswan(Alpine:v3.15) | < 3.29-r0 | 3.29-r0 |
| alpine/libreswan(Alpine:v3.16) | < 3.29-r0 | 3.29-r0 |
| alpine/libreswan(Alpine:v3.17) | < 3.29-r0 | 3.29-r0 |
| alpine/libreswan(Alpine:v3.18) | < 3.29-r0 | 3.29-r0 |
| alpine/libreswan(Alpine:v3.19) | < 3.29-r0 | 3.29-r0 |
| alpine/libreswan(Alpine:v3.20) | < 3.29-r0 | 3.29-r0 |
| alpine/libreswan(Alpine:v3.21) | < 3.29-r0 | 3.29-r0 |
| alpine/libreswan(Alpine:v3.22) | < 3.29-r0 | 3.29-r0 |
| alpine/libreswan(Alpine:v3.23) | < 3.29-r0 | 3.29-r0 |
| alpine/libreswan(Alpine:v3.24) | < 3.29-r0 | 3.29-r0 |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| The Libreswan Project libreswan | = 3.29 | No fix listed |
References
- Debian Security Tracker CVE-2019-10155 vendor-advisory
- RHSA-2019:3391 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- libreswan.org patch vendor-advisory
- FEDORA-2019-1bd9cfb718 vendor-advisory
- FEDORA-2019-f7fb531958 vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking