Description
An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent back. The notify payload's protocol ID is copied from the incoming packet, but the code that verifies outgoing packets fails an assertion that the protocol ID must be ESP (2) or AH(3) and causes the pluto daemon to crash and restart. NOTE: the earliest affected version is 3.20.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | libreswan | 4.12-1 | — |
| Debian 12 | libreswan | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libreswan | No fix yet | — |
| Ubuntu 26.04 LTS | libreswan | No fix yet | — |
| Ubuntu 25.10 | libreswan | No fix yet | — |
| Ubuntu 24.04 LTS | libreswan | No fix yet | — |
| Ubuntu 22.04 LTS | libreswan | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libreswan | No fix yet | — |
| Ubuntu 18.04 LTS | libreswan | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | libreswan | 4.12-1.el9 | RHSA-2023:6549 |
| RHEL 8 | libreswan | 4.12-2.el8 | RHSA-2023:7052 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | libreswan | 4.9-5.el9_2.4 | RHSA-2025:0309 |
| RHEL 9.0 E4S | libreswan | 4.6-3.el9_0.3 | RHSA-2024:10594 |
| Red Hat OpenShift 4 | libreswan | 4.6-3.el9_0.3 | RHBA-2024:11565, RHBA-2024:11525, RHBA-2024:11505 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | libreswan | 4.12-1.el9 | ALSA-2023:6549 |
| AlmaLinux 8 | libreswan | 4.12-2.el8 | ALSA-2023:7052 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | libreswan | 4.12-2.el8_10.3 | RLSA-2023:7052 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libreswan | 4.12-r0 | — |
| Alpine v3.23 | libreswan | 4.12-r0 | — |
| Alpine v3.22 | libreswan | 4.12-r0 | — |
| Alpine v3.21 | libreswan | 4.12-r0 | — |
| Alpine v3.20 | libreswan | 4.12-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | libreswan | 4.12-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libreswan | 4.7-6 | — |
| Azure Linux 2 (CBL-Mariner) | libreswan | 4.7-5 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | libreswan | 4.12-1.0.1.el9 | ELSA-2023-6549 |
| Oracle Linux 8 | libreswan | 4.12-2.0.1.el8 | ELSA-2023-7052 |
Advisories 13
- WID-SEC-2023-2853 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- ALSA-2023:6549 Moderate: libreswan security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:7052 Moderate: libreswan security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:0309 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Aug 26, 2026
- RHSA-2024:10594 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Aug 26, 2026
- RHSA-2023:7052 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Aug 26, 2026
- RHSA-2023:6549 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Aug 26, 2026
- RLSA-2023:7052 Moderate: libreswan security update Rocky Linux Security Advisories · May 21, 2026
- RHBA-2024:11505 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.16.28 packages and security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
- RHBA-2024:11565 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.15.42 packages update Red Hat Security Advisories (RHSA) · Jan 29, 2026
- RHBA-2024:11525 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.17.10 packages and security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
- ELSA-2023-7052 Moderate: libreswan security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 17, 2023
- ELSA-2023-6549 Moderate: libreswan security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 11, 2023