{"id":"CVE-2019-12312","aliases":["ALPINE-CVE-2019-12312","DEBIAN-CVE-2019-12312","EUVD-2019-3949","GHSA-mg44-55g8-hfpm","RHSA-2019:3391"],"status":"published","title":"In Libreswan before 3.28, an assertion failure can lead to a pluto IKE daemon restart. An...","description":"In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02748,"percentile":0.86305,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476","CWE-617"],"published":"2019-05-24T13:06:41Z","modified":"2026-11-06T17:26:19Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"libreswan","fixed_in":["3.28-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"libreswan","fixed_in":["3.28-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"libreswan","fixed_in":["3.28-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libreswan","fixed_in":["3.28-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libreswan","fixed_in":["3.28-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libreswan","fixed_in":["3.28-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libreswan","fixed_in":["3.28-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libreswan","fixed_in":["3.28-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libreswan","fixed_in":["3.28-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libreswan","fixed_in":["3.28-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libreswan","fixed_in":["3.28-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libreswan","fixed_in":["3.28-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libreswan","fixed_in":["3.28-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libreswan","fixed_in":["3.28-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libreswan","fixed_in":["3.27-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libreswan","fixed_in":["3.27-5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27-5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.29-6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.29-6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libreswan-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.29-6.el8"}]}],"bundled":2}],"products":[{"vendor":"libreswan","product":"libreswan"}],"references":[{"url":"http://www.iwantacve.cn/index.php/archives/218/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/libreswan/libreswan/issues/246","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/libreswan/libreswan/compare/9b1394e...3897683","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://libreswan.org/security/CVE-2019-12312/CVE-2019-12312.txt","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://libreswan.org/security/CVE-2019-12312/libreswan-3.27-CVE-2019-12312.patch","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12312","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mg44-55g8-hfpm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-12312","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-12312","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3391","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1608353","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1679394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1683706","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1699318","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1706180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1712555","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1713734","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1714141","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1714331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723957","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3391.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10155","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10155","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10155","tags":["advisory"]},{"url":"https://libreswan.org/security/CVE-2019-10155/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-12312","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1716918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-12312","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-12312","description":"In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.","status":"published","published":"2019-05-24T13:06:41Z","modified":"2024-08-04T23:17:40.062Z","updated_at":"2026-11-02T14:20:24.025419Z"}],"euvd":[{"id":"EUVD-2019-3949","description":"In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.","status":"published","published":"2019-05-24T13:06:41Z","modified":"2024-08-04T23:17:40Z","updated_at":"2026-11-03T02:40:45.973526Z"}],"ghsa":[{"id":"GHSA-mg44-55g8-hfpm","title":"In Libreswan before 3.28, an assertion failure can lead to a pluto IKE daemon restart. An...","description":"In Libreswan before 3.28, an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by sending two IKEv2 packets (init_IKE and delete_IKE) in 3des_cbc mode to a Libreswan server. This affects send_v2N_spi_response_from_state in programs/pluto/ikev2_send.c when built with Network Security Services (NSS).","status":"published","published":"2022-05-24T16:46:36Z","modified":"2023-01-28T05:05:13Z","updated_at":"2026-11-02T14:44:19.055406Z"}],"nvd":[{"id":"CVE-2019-12312","description":"In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.","status":"published","published":"2019-05-24T14:29:00.23Z","modified":"2026-06-17T02:14:24.54Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476","CWE-617"],"updated_at":"2026-11-02T14:05:14.729983Z"}],"osv":[{"id":"ALPINE-CVE-2019-12312","description":"In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.","status":"published","published":"2019-05-24T14:29:00.23Z","modified":"2026-11-03T06:31:34.980002271Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:18:23.800469Z"},{"id":"CVE-2019-12312","description":"In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.","status":"published","published":"2019-05-24T14:29:00.23Z","modified":"2026-10-20T10:50:39.675149802Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"DEBIAN-CVE-2019-12312","description":"In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.","status":"published","published":"2019-05-24T14:29:00.23Z","modified":"2026-11-06T17:26:19.637130947Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T18:04:44.027546Z"},{"id":"RHSA-2019:3391","title":"Red Hat Security Advisory: libreswan security and bug fix update","status":"published","published":"2024-09-16T02:35:17Z","modified":"2026-01-14T11:03:25.223379Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"}]}}