QwikSec

Security Database

CVE

CWE

Training

CVE-2020-1763

Published: May 12, 2020

Modified: Aug 4, 2024

PUBLISHED

CVSS v3.1

7.5

HIGH

Description

An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.

Vendor	Product	Versions
the libreswan Project	libreswan	affected `from versions 3.27 till 3.31`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

References

https://libreswan.org/security/CVE-2020-1763/CVE-2020-1763.txt

x_refsource_CONFIRM

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1763

x_refsource_CONFIRM

https://bugzilla.redhat.com/show_bug.cgi?id=1813329

x_refsource_MISC

https://github.com/libreswan/libreswan/commit/471a3e41a449d7c753bc4edbba4239501bb62ba8

x_refsource_CONFIRM

vendor-advisory

x_refsource_DEBIAN

vendor-advisory

x_refsource_GENTOO

https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf

x_refsource_CONFIRM

https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.