Red Hat Security Advisory: libreswan security update
An update for libreswan is available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-2357US | — | — | ||
The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys (authby=secre… | ||||
references
External citations — patches, advisories, analysis.
remediations (26)
- Fixedlibreswan-0:4.12-2.el8_9.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:1998 - Fixedlibreswan-0:4.12-2.el8_9.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:1998 - Fixedlibreswan-0:4.12-2.el8_9.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:1998 - Fixedlibreswan-0:4.12-2.el8_9.2.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:1998 - Fixedlibreswan-0:4.12-2.el8_9.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:1998 - Fixedlibreswan-debuginfo-0:4.12-2.el8_9.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:1998 - Fixedlibreswan-debuginfo-0:4.12-2.el8_9.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:1998 - Fixedlibreswan-debuginfo-0:4.12-2.el8_9.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:1998 - Fixedlibreswan-debuginfo-0:4.12-2.el8_9.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:1998 - Fixedlibreswan-debugsource-0:4.12-2.el8_9.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:1998 - Fixedlibreswan-debugsource-0:4.12-2.el8_9.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:1998 - Fixedlibreswan-debugsource-0:4.12-2.el8_9.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:1998 - Fixedlibreswan-debugsource-0:4.12-2.el8_9.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:1998 - Workaroundlibreswan-0:4.12-2.el8_9.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
As a workaround to prevent the misconfiguration from causing the crash, place an unguessable long random "catch-all" secret in /etc/ipsec.secrets, for example, using the following command: echo -e "# CVE-2024-2357 workaround\n: PSK \"$(openssl rand -hex 32)\"" >> /etc/ipsec.secrets This will ensure a PSK secret is always found, but it will always be wrong, and thus authentication will still properly fail.
- Workaroundlibreswan-0:4.12-2.el8_9.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
As a workaround to prevent the misconfiguration from causing the crash, place an unguessable long random "catch-all" secret in /etc/ipsec.secrets, for example, using the following command: echo -e "# CVE-2024-2357 workaround\n: PSK \"$(openssl rand -hex 32)\"" >> /etc/ipsec.secrets This will ensure a PSK secret is always found, but it will always be wrong, and thus authentication will still properly fail.
- Workaroundlibreswan-0:4.12-2.el8_9.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
As a workaround to prevent the misconfiguration from causing the crash, place an unguessable long random "catch-all" secret in /etc/ipsec.secrets, for example, using the following command: echo -e "# CVE-2024-2357 workaround\n: PSK \"$(openssl rand -hex 32)\"" >> /etc/ipsec.secrets This will ensure a PSK secret is always found, but it will always be wrong, and thus authentication will still properly fail.
- Workaroundlibreswan-0:4.12-2.el8_9.2.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
As a workaround to prevent the misconfiguration from causing the crash, place an unguessable long random "catch-all" secret in /etc/ipsec.secrets, for example, using the following command: echo -e "# CVE-2024-2357 workaround\n: PSK \"$(openssl rand -hex 32)\"" >> /etc/ipsec.secrets This will ensure a PSK secret is always found, but it will always be wrong, and thus authentication will still properly fail.
- Workaroundlibreswan-0:4.12-2.el8_9.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
As a workaround to prevent the misconfiguration from causing the crash, place an unguessable long random "catch-all" secret in /etc/ipsec.secrets, for example, using the following command: echo -e "# CVE-2024-2357 workaround\n: PSK \"$(openssl rand -hex 32)\"" >> /etc/ipsec.secrets This will ensure a PSK secret is always found, but it will always be wrong, and thus authentication will still properly fail.
- Workaroundlibreswan-debuginfo-0:4.12-2.el8_9.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
As a workaround to prevent the misconfiguration from causing the crash, place an unguessable long random "catch-all" secret in /etc/ipsec.secrets, for example, using the following command: echo -e "# CVE-2024-2357 workaround\n: PSK \"$(openssl rand -hex 32)\"" >> /etc/ipsec.secrets This will ensure a PSK secret is always found, but it will always be wrong, and thus authentication will still properly fail.
- Workaroundlibreswan-debuginfo-0:4.12-2.el8_9.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
As a workaround to prevent the misconfiguration from causing the crash, place an unguessable long random "catch-all" secret in /etc/ipsec.secrets, for example, using the following command: echo -e "# CVE-2024-2357 workaround\n: PSK \"$(openssl rand -hex 32)\"" >> /etc/ipsec.secrets This will ensure a PSK secret is always found, but it will always be wrong, and thus authentication will still properly fail.
- Workaroundlibreswan-debuginfo-0:4.12-2.el8_9.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
As a workaround to prevent the misconfiguration from causing the crash, place an unguessable long random "catch-all" secret in /etc/ipsec.secrets, for example, using the following command: echo -e "# CVE-2024-2357 workaround\n: PSK \"$(openssl rand -hex 32)\"" >> /etc/ipsec.secrets This will ensure a PSK secret is always found, but it will always be wrong, and thus authentication will still properly fail.
- Workaroundlibreswan-debuginfo-0:4.12-2.el8_9.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
As a workaround to prevent the misconfiguration from causing the crash, place an unguessable long random "catch-all" secret in /etc/ipsec.secrets, for example, using the following command: echo -e "# CVE-2024-2357 workaround\n: PSK \"$(openssl rand -hex 32)\"" >> /etc/ipsec.secrets This will ensure a PSK secret is always found, but it will always be wrong, and thus authentication will still properly fail.
- Workaroundlibreswan-debugsource-0:4.12-2.el8_9.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
As a workaround to prevent the misconfiguration from causing the crash, place an unguessable long random "catch-all" secret in /etc/ipsec.secrets, for example, using the following command: echo -e "# CVE-2024-2357 workaround\n: PSK \"$(openssl rand -hex 32)\"" >> /etc/ipsec.secrets This will ensure a PSK secret is always found, but it will always be wrong, and thus authentication will still properly fail.
- Workaroundlibreswan-debugsource-0:4.12-2.el8_9.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
As a workaround to prevent the misconfiguration from causing the crash, place an unguessable long random "catch-all" secret in /etc/ipsec.secrets, for example, using the following command: echo -e "# CVE-2024-2357 workaround\n: PSK \"$(openssl rand -hex 32)\"" >> /etc/ipsec.secrets This will ensure a PSK secret is always found, but it will always be wrong, and thus authentication will still properly fail.
- Workaroundlibreswan-debugsource-0:4.12-2.el8_9.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
As a workaround to prevent the misconfiguration from causing the crash, place an unguessable long random "catch-all" secret in /etc/ipsec.secrets, for example, using the following command: echo -e "# CVE-2024-2357 workaround\n: PSK \"$(openssl rand -hex 32)\"" >> /etc/ipsec.secrets This will ensure a PSK secret is always found, but it will always be wrong, and thus authentication will still properly fail.
- Workaroundlibreswan-debugsource-0:4.12-2.el8_9.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
As a workaround to prevent the misconfiguration from causing the crash, place an unguessable long random "catch-all" secret in /etc/ipsec.secrets, for example, using the following command: echo -e "# CVE-2024-2357 workaround\n: PSK \"$(openssl rand -hex 32)\"" >> /etc/ipsec.secrets This will ensure a PSK secret is always found, but it will always be wrong, and thus authentication will still properly fail.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan