Description
An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the deleted state causes the pluto daemon to crash and restart.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | libreswan | 4.12-1 | — |
| Debian 12 | libreswan | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libreswan | No fix yet | — |
| Ubuntu 26.04 LTS | libreswan | No fix yet | — |
| Ubuntu 25.10 | libreswan | No fix yet | — |
| Ubuntu 24.04 LTS | libreswan | No fix yet | — |
| Ubuntu 22.04 LTS | libreswan | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libreswan | No fix yet | — |
| Ubuntu 18.04 LTS | libreswan | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | libreswan | 4.12-1.el9 | RHSA-2023:6549 |
| RHEL 8 | libreswan | 4.12-2.el8 | RHSA-2023:7052 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | libreswan | 4.9-5.el9_2.4 | RHSA-2025:0309 |
| RHEL 9.0 E4S | libreswan | 4.6-3.el9_0.3 | RHSA-2024:10594 |
| Red Hat OpenShift 4 | libreswan | 4.6-3.el9_0.3 | RHBA-2024:11565, RHBA-2024:11525, RHBA-2024:11505 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | libreswan | 4.12-1.el9 | ALSA-2023:6549 |
| AlmaLinux 8 | libreswan | 4.12-2.el8 | ALSA-2023:7052 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | libreswan | 4.12-2.el8_10.3 | RLSA-2023:7052 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libreswan | 4.12-r0 | — |
| Alpine v3.23 | libreswan | 4.12-r0 | — |
| Alpine v3.22 | libreswan | 4.12-r0 | — |
| Alpine v3.21 | libreswan | 4.12-r0 | — |
| Alpine v3.20 | libreswan | 4.12-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | libreswan | 4.12-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | libreswan | 3.25-4.8.amzn2.0.2 | ALAS2-2023-2299 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libreswan | 4.7-6 | — |
| Azure Linux 2 (CBL-Mariner) | libreswan | 4.7-5 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | libreswan | 4.12-1.0.1.el9 | ELSA-2023-6549 |
| Oracle Linux 8 | libreswan | 4.12-2.0.1.el8 | ELSA-2023-7052 |
Advisories 14
- WID-SEC-2023-2853 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- ALSA-2023:6549 Moderate: libreswan security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:7052 Moderate: libreswan security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:0309 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Aug 26, 2026
- RHSA-2024:10594 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Aug 26, 2026
- RHSA-2023:7052 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Aug 26, 2026
- RHSA-2023:6549 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Aug 26, 2026
- RLSA-2023:7052 Moderate: libreswan security update Rocky Linux Security Advisories · May 21, 2026
- RHBA-2024:11505 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.16.28 packages and security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
- RHBA-2024:11565 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.15.42 packages update Red Hat Security Advisories (RHSA) · Jan 29, 2026
- RHBA-2024:11525 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.17.10 packages and security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
- ELSA-2023-7052 Moderate: libreswan security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 17, 2023
- ELSA-2023-6549 Moderate: libreswan security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 11, 2023
- ALAS2-2023-2299 Moderate: libreswan security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 19, 2023