An issue was discovered in Libreswan before 4.12.
Priority LOW 30Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 7 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent back. The notify payload's protocol ID is copied from the incoming packet, but the code that verifies outgoing packets fails an assertion that the protocol ID must be ESP (2) or AH(3) and causes the pluto daemon to crash and restart. NOTE: the earliest affected version is 3.20.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00813 57th percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 7 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libreswan:libreswan:*:*:*:*:*:*:*:* | 3.20 to before 4.12 | Vulnerable | The Libreswan Project |
- cpe:2.3:a:libreswan:libreswan:*:*:*:*:*:*:*:* Versions 3.20 to before 4.12 Vulnerable ·The Libreswan Project
Remediation
Red Hat 4 advisories
- RHSA-2025:0309 Released 2025-01-14 · Red Hat rating Moderatelibreswan security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) libreswan-4.9-5.el9_2.4
- RHSA-2024:10594 Released 2024-12-02 · Red Hat rating Moderatelibreswan security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) libreswan-4.6-3.el9_0.3
- RHSA-2023:7052 Released 2023-11-14 · Red Hat rating Moderatelibreswan security update
- Red Hat Enterprise Linux AppStream (v. 8) libreswan-4.12-2.el8
Show 1 more Red Hat advisories
- RHSA-2023:6549 Released 2023-11-07 · Red Hat rating Moderatelibreswan security update
- Red Hat Enterprise Linux AppStream (v. 9) libreswan-4.12-1.el9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:7052 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:6549 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2024:10594 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2025:0309 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | — |
| Red Hat OpenShift Container Platform 4.16 | Fixed | — |
| Red Hat OpenShift Container Platform 4.17 | Fixed | — |
Not affected: 2 products
- Red Hat Enterprise Linux 6
- Red Hat OpenShift Container Platform 4.17
Timeline
- 2026-10-02 Threatist record created from CVE-2023-38710
- 2026-10-03 Alias added: GHSA-4967-9mw7-522q
References
More The Libreswan Project Libreswan vulnerabilities
- TI-2023-09114 Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and… CVSS 3.1MEDIUM 6.5
- TI-2013-05949 Race condition in the libreswan.spec files for Red Hat Enterprise Linux (RHEL) and Fedora… CVSS 2.0HIGH 9.3
- TI-2023-02152 Uncontrolled resource consumption in libreswan CVSS 3.1HIGH 7.5
- TI-2026-37395 IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload CVSS 3.1HIGH 8.1
- TI-2026-37394 IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload CVSS 3.1HIGH 8.1
- TI-2023-14401 pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and… CVSS 3.1HIGH 7.5
Sources
- CVE-2023-38710 · CVE Program
- CVE-2023-38710 · NVD
- FIRST EPSS
- GHSA-4967-9mw7-522q · GitHub Advisory Database · CC BY 4.0
- CVE-2023-38710 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences