Red Hat Security AdvisoryRHSA-2026:82154
libreswan security update
Released 2026-10-13 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v.8.6) libreswan-4.5-1.el8_6.6
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) libreswan-4.5-1.el8_6.6
Fixes 3 records
Priority MEDIUM 41
Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017).
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00346 · Published 2026-07-02 · Partial fix · 5.3.1 CWE-347
Priority MEDIUM 41
Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as pe…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00386 · Published 2026-07-02 · Partial fix · 5.3.1 CWE-347
Priority LOW 39
In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00468 · Published 2026-09-02 · Partial fix · 5.3.2 CWE-252
