Vulnerability Description
An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Libreswan | Libreswan | >= 3.27, <= 3.31 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1813329Issue TrackingThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1763Issue TrackingThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdfThird Party Advisory
- https://github.com/libreswan/libreswan/commit/471a3e41a449d7c753bc4edbba4239501bPatchThird Party Advisory
- https://libreswan.org/security/CVE-2020-1763/CVE-2020-1763.txtPatchVendor Advisory
- https://security.gentoo.org/glsa/202007-21Third Party Advisory
- https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04Third Party AdvisoryUS Government Resource
- https://www.debian.org/security/2020/dsa-4684Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1813329Issue TrackingThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1763Issue TrackingThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdfThird Party Advisory
- https://github.com/libreswan/libreswan/commit/471a3e41a449d7c753bc4edbba4239501bPatchThird Party Advisory
- https://libreswan.org/security/CVE-2020-1763/CVE-2020-1763.txtPatchVendor Advisory
- https://security.gentoo.org/glsa/202007-21Third Party Advisory
- https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04Third Party AdvisoryUS Government Resource
FAQ
What is CVE-2020-1763?
CVE-2020-1763 is a vulnerability with a CVSS score of 7.5 (HIGH). An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially...
How severe is CVE-2020-1763?
CVE-2020-1763 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-1763?
Check the references section above for vendor advisories and patch information. Affected products include: Libreswan Libreswan.