Every CVE Search/ Get API key

CVE-2019-10155

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange...

3.1 LowFix available

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.50%Down 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 3.1

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.

Record
CVE-2019-10155
CVSS 3.0
3.1 LowCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-354
Updated
2026-11-02
EUVDEUVD-2019-2191 3.1

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.

Record
EUVD-2019-2191
CVSS 3.0
3.1 LowCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-m236-w45w-74ch 3.1

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange...

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.

Record
GHSA-m236-w45w-74ch
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-354
Updated
2026-11-02
NVD 3.1

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.

Record
CVE-2019-10155
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.0
3.1 LowCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:N/I:N/A:P
Weakness
CWE-354
Updated
2026-11-02
OSVALPINE-CVE-2019-10155 3.1

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.

Record
ALPINE-CVE-2019-10155
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-03
OSV 3.1

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.

Record
CVE-2019-10155
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2019-10155 3.1

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.

Record
DEBIAN-CVE-2019-10155
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2019:3391 4.3

Red Hat Security Advisory: libreswan security and bug fix update

Record
RHSA-2019:3391
CVSS 3.0
4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2019-10155 3.1

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.

Record
UBUNTU-CVE-2019-10155
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.0
3.1 LowCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVMGASA-2019-0210 No score

Updated libreswan packages fix security vulnerability

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29 (CVE-2019-10155).

Record
MGASA-2019-0210
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libreswan
Alpine:v3.11
 before 3.29-r0
3.29-r0
libreswan
Alpine:v3.12
 before 3.29-r0
3.29-r0
libreswan
Alpine:v3.13
 before 3.29-r0
3.29-r0
libreswan
Alpine:v3.14
 before 3.29-r0
3.29-r0
libreswan
Alpine:v3.15
 before 3.29-r0
3.29-r0
libreswan
Alpine:v3.16
 before 3.29-r0
3.29-r0
libreswan
Alpine:v3.17
 before 3.29-r0
3.29-r0
libreswan
Alpine:v3.18
 before 3.29-r0
3.29-r0
libreswan
Alpine:v3.19
 before 3.29-r0
3.29-r0
libreswan
Alpine:v3.20
 before 3.29-r0
3.29-r0
Show 16 moreShow less
Affected packages
PackageAffectedFixed
libreswan
Alpine:v3.21
 before 3.29-r0
3.29-r0
libreswan
Alpine:v3.22
 before 3.29-r0
3.29-r0
libreswan
Alpine:v3.23
 before 3.29-r0
3.29-r0
libreswan
Alpine:v3.24
 before 3.29-r0
3.29-r0
libreswan
Debian:12
 before 3.27-6
3.27-6
libreswan
Debian:13
 before 3.27-6
3.27-6
libreswan
Debian:14
 before 3.27-6
3.27-6
strongswan
Debian:12
 before 5.1.0-1
5.1.0-1
strongswan
Debian:13
 before 5.1.0-1
5.1.0-1
strongswan
Debian:14
 before 5.1.0-1
5.1.0-1
libreswan
Mageia:7
 before 3.29-1.1.mga7
3.29-1.1.mga7
unbound
Mageia:7
 before 1.9.1-1.1.mga7
1.9.1-1.1.mga7
libreswan
Red Hat:enterprise_linux:8::appstream
 before 0:3.29-6.el8
0:3.29-6.el8
libreswan-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.29-6.el8
0:3.29-6.el8
libreswan-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:3.29-6.el8
0:3.29-6.el8
libreswan
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.20-7build13.21-23.22-13.22-23.22-33.22-43.23-13.23-4
 None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-10155 is a low vulnerability (CVSS 3.1) in Libreswan, published June 12, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 42nd percentile. Fixed in libreswan 3.29-r0.

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open