CVE-2020-1763

May 5, 2021

An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.

Summary:

An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.

Reference Links(if available):

  • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1763
  • https://github.com/libreswan/libreswan/commit/471a3e41a449d7c753bc4edbba4239501bb62ba8
  • https://bugzilla.redhat.com/show_bug.cgi?id=1813329
  • https://libreswan.org/security/CVE-2020-1763/CVE-2020-1763.txt
  • https://www.debian.org/security/2020/dsa-4684

    • CVSS Score (if available)

    v2: / MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P

    v3: / HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

    Links to Exploits(if available)

  • Tags: , , , ,

    You may have missed

    CISA_Logo

    CISA: CISA Adds Three Known Exploited Vulnerabilities to Catalog

    December 24, 2024
    CISA_Logo

    CISA: CISA Releases Eight Industrial Control Systems Advisories

    December 24, 2024
    CISA_Logo

    CISA: CISA Adds One Known Exploited Vulnerability to Catalog

    December 24, 2024
    CISA_Logo

    CISA: CISA Releases Six Industrial Control Systems Advisories

    December 24, 2024
    CISA_Logo

    CISA: CISA and Partners Release Joint Guidance on PRC-Affiliated Threat Actor Compromising Networks of Global Telecommunications Providers

    December 24, 2024