{"id":"CVE-2013-6466","aliases":["DSA-2893-1","EUVD-2013-6270","GHSA-gc3w-rhj3-96v9","MGASA-2014-0097","RHSA-2014:0185"],"status":"published","title":"Openswan 2.6.39 and earlier allows remote attackers to cause a denial of service (NULL pointer...","description":"Openswan 2.6.39 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02664,"percentile":0.85819,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2014-01-26T20:00:00Z","modified":"2026-06-26T10:23:25Z","fixes":[{"ecosystem":"Mageia:3","package":"openswan","fixed_in":["2.6.28-5.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"openswan","fixed_in":["2.6.39-3.1.mga4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"openswan","fixed_in":["0:2.6.32-7.3.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"openswan-debuginfo","fixed_in":["0:2.6.32-7.3.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"openswan-doc","fixed_in":["0:2.6.32-7.3.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"openswan","fixed_in":["0:2.6.32-7.3.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"openswan-debuginfo","fixed_in":["0:2.6.32-7.3.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"openswan-doc","fixed_in":["0:2.6.32-7.3.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openswan","fixed_in":["0:2.6.32-27.2.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openswan-debuginfo","fixed_in":["0:2.6.32-27.2.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openswan-doc","fixed_in":["0:2.6.32-27.2.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openswan","fixed_in":["0:2.6.32-27.2.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openswan-debuginfo","fixed_in":["0:2.6.32-27.2.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openswan-doc","fixed_in":["0:2.6.32-27.2.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openswan","fixed_in":["0:2.6.32-27.2.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openswan-debuginfo","fixed_in":["0:2.6.32-27.2.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openswan-doc","fixed_in":["0:2.6.32-27.2.el6_5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"openswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.6.28+dfsg-5+squeeze2"}]}],"versions":["1:2.6.28+dfsg-5","1:2.6.28+dfsg-5+squeeze1","1:2.6.28+dfsg-5+squeeze1~bpo50+1"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"openswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.6.37-3+deb7u1"}]}],"versions":["1:2.6.37-3"],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"openswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.28-5.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"openswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.39-3.1.mga4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"openswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.32-7.3.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"openswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.32-7.3.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"openswan-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.32-7.3.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"openswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.32-7.3.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"openswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.32-7.3.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"openswan-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.32-7.3.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.32-27.2.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.32-27.2.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openswan-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.32-27.2.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.32-27.2.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.32-27.2.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openswan-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.32-27.2.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.32-27.2.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.32-27.2.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openswan-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.32-27.2.el6_5"}]}]}],"products":[{"vendor":"xelerance","product":"openswan"}],"references":[{"url":"https://libreswan.org/security/CVE-2013-6467/CVE-2013-6467.txt","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","article"]},{"url":"http://www.securityfocus.com/bid/65155","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://cert.vde.com/en-us/advisories/vde-2017-001","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0185.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.debian.org/security/2014/dsa-2893","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/90524","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6466","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gc3w-rhj3-96v9"},{"url":"https://advisories.mageia.org/MGASA-2014-0097.html","tags":["advisory"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-0185.html","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12823","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0185","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1050277","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0185.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6466","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6466","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-6466","description":"Openswan 2.6.39 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads.","status":"published","published":"2014-01-26T20:00:00Z","modified":"2024-08-06T17:39:01.444Z","updated_at":"2026-11-02T14:34:57.499208Z"}],"euvd":[{"id":"EUVD-2013-6270","description":"Openswan 2.6.39 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads.","status":"published","published":"2014-01-26T20:00:00Z","modified":"2024-08-06T17:39:01Z","updated_at":"2026-11-03T01:56:26.306678Z"}],"ghsa":[{"id":"GHSA-gc3w-rhj3-96v9","title":"Openswan 2.6.39 and earlier allows remote attackers to cause a denial of service (NULL pointer...","description":"Openswan 2.6.39 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads.","status":"published","published":"2022-05-14T00:55:33Z","modified":"2023-02-02T05:02:36Z","updated_at":"2026-11-02T14:51:28.758736Z"}],"nvd":[{"id":"CVE-2013-6466","description":"Openswan 2.6.39 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads.","status":"published","published":"2014-01-26T20:55:05.33Z","modified":"2026-06-17T00:00:32.693Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"DSA-2893-1","title":"openswan - security update","status":"published","published":"2014-03-31T00:00:00Z","modified":"2026-03-09T01:21:11.864283Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0097","title":"Updated openswan packages fix CVE-2013-6466","description":"Updated openswan packages fix security vulnerability:\n\nA NULL pointer dereference flaw was discovered in the way Openswan's IKE\ndaemon processed IKEv2 payloads. A remote attacker could send specially\ncrafted IKEv2 payloads that, when processed, would lead to a denial of\nservice (daemon crash), possibly causing existing VPN connections to be\ndropped (CVE-2013-6466).\n","status":"published","published":"2014-02-25T21:39:07Z","modified":"2026-04-16T06:24:45.666699402Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"RHSA-2014:0185","title":"Red Hat Security Advisory: openswan security update","status":"published","published":"2024-09-15T21:20:07Z","modified":"2026-06-26T10:23:25Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}