{"id":"CVE-2019-10155","aliases":["ALPINE-CVE-2019-10155","DEBIAN-CVE-2019-10155","EUVD-2019-2191","GHSA-m236-w45w-74ch","MGASA-2019-0210","RHSA-2019:3391","UBUNTU-CVE-2019-10155"],"status":"published","title":"The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange...","description":"The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.","severity":{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.005,"percentile":0.43124,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-354"],"published":"2019-06-12T13:51:01Z","modified":"2026-11-06T17:26:18Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"libreswan","fixed_in":["3.29-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"libreswan","fixed_in":["3.29-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"libreswan","fixed_in":["3.29-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libreswan","fixed_in":["3.29-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libreswan","fixed_in":["3.29-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libreswan","fixed_in":["3.29-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libreswan","fixed_in":["3.29-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libreswan","fixed_in":["3.29-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libreswan","fixed_in":["3.29-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libreswan","fixed_in":["3.29-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libreswan","fixed_in":["3.29-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libreswan","fixed_in":["3.29-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libreswan","fixed_in":["3.29-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libreswan","fixed_in":["3.29-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libreswan","fixed_in":["3.27-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libreswan","fixed_in":["3.27-6"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"strongswan","fixed_in":["5.1.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"strongswan","fixed_in":["5.1.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"strongswan","fixed_in":["5.1.0-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"libreswan","fixed_in":["3.29-1.1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"unbound","fixed_in":["1.9.1-1.1.mga7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27-6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.29-6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.29-6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libreswan-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.29-6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.20-7build1","3.21-2","3.22-1","3.22-2","3.22-3","3.22-4","3.23-1","3.23-4"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libreswan","product":"libreswan"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"strongswan","product":"strongswan"},{"vendor":"the libreswan project","product":"libreswan"},{"vendor":"the libreswan project (www.libreswan.org)","product":"libreswan"},{"vendor":"xelerance","product":"openswan"}],"references":[{"url":"https://libreswan.org/security/CVE-2019-10155/","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","article","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10155","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFGPGLLKAXSLWFI62A6BZHTZSCHRCBXS/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUEXFCN7FAYBKJBQJLYCEUQUCHDEJRZW/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3391","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10155","tags":["advisory"]},{"url":"https://libreswan.org/security/CVE-2019-10155"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUEXFCN7FAYBKJBQJLYCEUQUCHDEJRZW"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFGPGLLKAXSLWFI62A6BZHTZSCHRCBXS"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUEXFCN7FAYBKJBQJLYCEUQUCHDEJRZW"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFGPGLLKAXSLWFI62A6BZHTZSCHRCBXS"},{"url":"https://github.com/advisories/GHSA-m236-w45w-74ch"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-10155","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-10155","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0210.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25065","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1608353","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1679394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1683706","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1699318","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1706180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1712555","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1713734","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1714141","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1714331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723957","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3391.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10155","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10155","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-12312","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1716918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-12312","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12312","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-10155","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-10155","description":"The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.","status":"published","published":"2019-06-12T13:51:01Z","modified":"2024-08-04T22:10:09.974Z","cvss":[{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-354"],"updated_at":"2026-11-02T14:20:19.056416Z"}],"euvd":[{"id":"EUVD-2019-2191","description":"The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.","status":"published","published":"2019-06-12T13:51:01Z","modified":"2024-08-04T22:10:09Z","cvss":[{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-03T02:40:54.154728Z"}],"ghsa":[{"id":"GHSA-m236-w45w-74ch","title":"The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange...","description":"The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.","status":"published","published":"2022-05-24T16:47:52Z","modified":"2024-04-04T00:56:06Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-354"],"updated_at":"2026-11-02T14:55:53.858593Z"}],"nvd":[{"id":"CVE-2019-10155","description":"The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.","status":"published","published":"2019-06-12T14:29:02.917Z","modified":"2026-06-17T02:10:22.337Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"primary"},{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-354"],"updated_at":"2026-11-02T14:05:16.285679Z"}],"osv":[{"id":"ALPINE-CVE-2019-10155","description":"The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.","status":"published","published":"2019-06-12T14:29:02.917Z","modified":"2026-11-03T06:32:34.682813007Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"CVE-2019-10155","description":"The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.","status":"published","published":"2019-06-12T14:29:02.917Z","modified":"2026-10-24T10:30:40.647855886Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"DEBIAN-CVE-2019-10155","description":"The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.","status":"published","published":"2019-06-12T14:29:02.917Z","modified":"2026-11-06T17:26:18.020431159Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-06T18:04:44.027546Z"},{"id":"RHSA-2019:3391","title":"Red Hat Security Advisory: libreswan security and bug fix update","status":"published","published":"2024-09-16T02:35:17Z","modified":"2026-01-14T11:03:25.223379Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"UBUNTU-CVE-2019-10155","description":"The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.","status":"published","published":"2019-06-12T14:29:00Z","modified":"2025-10-24T04:47:36Z","cvss":[{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"MGASA-2019-0210","title":"Updated libreswan packages fix security vulnerability","description":"The Libreswan Project has found a vulnerability in the processing of IKEv1\ninformational exchange packets which are encrypted and integrity protected\nusing the established IKE SA encryption and integrity keys, but as a\nreceiver, the integrity check value was not verified. This issue affects\nversions before 3.29 (CVE-2019-10155).\n","status":"published","published":"2019-07-21T18:17:27Z","modified":"2026-04-16T04:42:16.582256314Z","updated_at":"2026-11-02T15:49:40.793816Z"}]}}