Description
The pluto IKE daemon in libreswan before 3.15 and Openswan before 2.6.45, when built with NSS, allows remote attackers to cause a denial of service (assertion failure and daemon restart) via a zero DH g^x value in a KE payload in a IKE packet.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | libreswan | 3.15-5.ael7b_1 | RHSA-2015:1979 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | libreswan | 3.15-5.0.1.el7_1 | ELSA-2015-1979 |
Advisories 2
- RHSA-2015:1979 Red Hat Security Advisory: libreswan security and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- ELSA-2015-1979 Moderate: libreswan security and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 3, 2015
References
- RHSA-2015:1979 vendor-advisory
- 1033418 vdb-entry
- 77536 vdb-entry
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- GLSA-201603-13 vendor-advisory
- https://libreswan.org/security/CVE-2015-3240/CVE-2015-3240.txt
- [Openswan Users] 20150827 Openswan 2.6.45 released mailing-list