Description
libreswan 3.9 through 3.12 allows remote attackers to cause a denial of service (daemon restart) via an IKEv1 packet with (1) unassigned bits set in the IPSEC DOI value or (2) the next payload value set to ISAKMP_NEXT_SAK.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | libreswan | 3.12-10.1.ael7b_1 | RHSA-2015:1154 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | libreswan | 3.12-10.1.0.1.el7_1 | ELSA-2015-1154 |
Advisories 2
- RHSA-2015:1154 Red Hat Security Advisory: libreswan security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- ELSA-2015-1154 Moderate: libreswan security, bug fix and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 23, 2015
References
- https://libreswan.org/security/CVE-2015-3204/CVE-2015-3204.txt
- RHSA-2015:1154 vendor-advisory
- GLSA-201603-13 vendor-advisory
- 75392 vdb-entry