{"id":"CVE-2024-3652","aliases":["ALPINE-CVE-2024-3652","ALSA-2024:4050","ALSA-2024:4376","AZL-39919","AZL-39927","CLSA-2025-1752749664","DEBIAN-CVE-2024-3652","EUVD-2024-32230","GHSA-395v-96gv-76w3","MGASA-2024-0138","OESA-2024-1565","RHBA-2024:11505","RHBA-2024:11525","RHBA-2024:11565","RHSA-2024:4050","RHSA-2024:4200","RHSA-2024:4376","RHSA-2024:4377","RHSA-2024:4417","RHSA-2024:4431","RLSA-2024:4050","RLSA-2024:4376","UBUNTU-CVE-2024-3652"],"status":"published","title":"IKEv1 default AH/ESP responder can cause libreswan to abort and restart","description":"The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.008,"percentile":0.57023,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-404"],"published":"2024-04-11T01:32:13Z","modified":"2026-11-06T17:28:05Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"libreswan","fixed_in":["4.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libreswan","fixed_in":["4.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libreswan","fixed_in":["4.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libreswan","fixed_in":["4.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libreswan","fixed_in":["4.15-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libreswan","fixed_in":["4.12-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libreswan","fixed_in":["4.12-2.el8_10.4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libreswan","fixed_in":["4.15-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libreswan","fixed_in":["4.14-2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libreswan","fixed_in":["4.9-4.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libreswan","fixed_in":["4.15-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"libreswan","fixed_in":["4.15-1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"libreswan","fixed_in":["4.15-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libreswan","fixed_in":["4.15-1.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"libreswan","fixed_in":["4.15-1.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"libreswan","fixed_in":["4.15-1.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"libreswan","fixed_in":["4.15-1.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"libreswan","fixed_in":["4.15-1.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libreswan","fixed_in":["0:4.12-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libreswan-debuginfo","fixed_in":["0:4.12-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libreswan-debugsource","fixed_in":["0:4.12-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"libreswan","fixed_in":["0:4.9-3.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"libreswan-debuginfo","fixed_in":["0:4.9-3.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"libreswan-debugsource","fixed_in":["0:4.9-3.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libreswan","fixed_in":["0:4.12-2.el8_10.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libreswan-debuginfo","fixed_in":["0:4.12-2.el8_10.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libreswan-debugsource","fixed_in":["0:4.12-2.el8_10.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libreswan","fixed_in":["0:4.6-3.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libreswan-debuginfo","fixed_in":["0:4.6-3.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libreswan-debugsource","fixed_in":["0:4.6-3.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"libreswan","fixed_in":["0:4.5-1.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"libreswan-debuginfo","fixed_in":["0:4.5-1.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"libreswan-debugsource","fixed_in":["0:4.5-1.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"libreswan","fixed_in":["0:4.5-1.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"libreswan-debuginfo","fixed_in":["0:4.5-1.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"libreswan-debugsource","fixed_in":["0:4.5-1.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"libreswan","fixed_in":["0:4.5-1.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"libreswan-debuginfo","fixed_in":["0:4.5-1.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"libreswan-debugsource","fixed_in":["0:4.5-1.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"libreswan","fixed_in":["0:4.9-5.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"libreswan-debuginfo","fixed_in":["0:4.9-5.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"libreswan-debugsource","fixed_in":["0:4.9-5.el9_2.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"libreswan","fixed_in":["0:4.12-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"libreswan","fixed_in":["0:4.12-2.el8_10.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.22"},{"fixed":"4.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.22"},{"fixed":"4.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.22"},{"fixed":"4.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.22"},{"fixed":"4.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.22"},{"fixed":"4.15-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12-2.el8_10.4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14-2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-4.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.10-2","4.10-2+deb12u1","4.11-1","4.12-1","4.12-2","4.12-3","4.14-1","4.14-1.1","4.15-1","5.0~rc2-1","5.0~rc2-2","5.2-1","5.2-2","5.2-2.1","5.2-2.2","5.2-2.3","5.2-2.4","5.2-2.5"]},{"source":"osv","ecosystem":"Debian:13","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-1.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-1.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-1.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-1.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-1.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6-3.el9_0.3"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6-3.el9_0.3"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"libreswan-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6-3.el9_0.3"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6-3.el9_0.3"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6-3.el9_0.3"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"libreswan-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6-3.el9_0.3"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6-3.el9_0.3"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6-3.el9_0.3"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"libreswan-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6-3.el9_0.3"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libreswan-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9-3.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9-3.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"libreswan-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9-3.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12-2.el8_10.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12-2.el8_10.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libreswan-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12-2.el8_10.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6-3.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6-3.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libreswan-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6-3.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5-1.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5-1.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"libreswan-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5-1.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5-1.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5-1.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"libreswan-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5-1.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5-1.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5-1.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"libreswan-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5-1.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9-5.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9-5.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"libreswan-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9-5.el9_2.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12-2.el8_10.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.20-7build1","3.21-2","3.22-1","3.22-2","3.22-3","3.22-4","3.23-1","3.23-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.29-2","3.29-2build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.32-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11-1ubuntu1","4.12-1ubuntu1","4.14-1ubuntu1","4.14-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.14-1ubuntu2","5.2-2.2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2-2.2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2-2.2ubuntu1","5.2-2.2ubuntu2"]}],"products":[{"vendor":"libreswan","product":"libreswan"},{"vendor":"the libreswan project (www.libreswan.org)","product":"libreswan"}],"references":[{"url":"https://libreswan.org/security/CVE-2024-3652","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2024/04/18/2","tags":["x_transferred","Mailing List","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3652","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-395v-96gv-76w3"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-3652","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4050","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-3652","tags":["report"]},{"url":"https://bugzilla.redhat.com/2274448","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-4050.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4376","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-4376.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1752749664.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-3652","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0138.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33105","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1565","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2024:11505","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2024_11505.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-2295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2189777","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-2295","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2295","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2173610","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23009","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23009","tags":["advisory"]},{"url":"https://github.com/libreswan/libreswan/issues/954","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-30570","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2187165","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-30570","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30570","tags":["advisory"]},{"url":"https://libreswan.org/security/","tags":["article"]},{"url":"https://libreswan.org/security/CVE-2023-30570/CVE-2023-30570.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38710","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2225368","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38710","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38710","tags":["advisory"]},{"url":"https://github.com/libreswan/libreswan/releases/tag/v4.12","tags":["article"]},{"url":"https://libreswan.org/security/CVE-2023-38710/CVE-2023-38710.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38711","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2215952","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38711","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38711","tags":["advisory"]},{"url":"https://libreswan.org/security/CVE-2023-38711/CVE-2023-38711.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38712","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2225369","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38712","tags":["advisory"]},{"url":"https://libreswan.org/security/CVE-2023-38712/CVE-2023-38712.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2357","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268952","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2357","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2357","tags":["advisory"]},{"url":"https://github.com/libreswan/libreswan/commit/cb9e1047d33fde695d63a95854c2bc2470a476c8.patch","tags":["article"]},{"url":"https://libreswan.org/security/CVE-2024-2357","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274448","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-3652","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHBA-2024:11525","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2024_11525.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2024:11565","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2024_11565.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4050.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4200","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4200.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4376.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4377","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4377.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4417","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4417.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4431","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4431.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:4050","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:4376","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-3652","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-3652","title":"IKEv1 default AH/ESP responder can cause libreswan to abort and restart","description":"The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.","status":"published","published":"2024-04-11T01:32:13.433Z","modified":"2026-02-27T15:19:48.988Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-404"],"updated_at":"2026-11-02T14:34:10.961618Z"}],"euvd":[{"id":"EUVD-2024-32230","description":"The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.","status":"published","published":"2024-04-11T01:32:13Z","modified":"2026-02-27T15:19:48Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:48:14.049749Z"}],"ghsa":[{"id":"GHSA-395v-96gv-76w3","title":"The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1...","description":"The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.","status":"published","published":"2024-04-11T03:35:00Z","modified":"2025-06-17T21:31:43Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-404"],"updated_at":"2026-11-02T15:02:45.097525Z"}],"nvd":[{"id":"CVE-2024-3652","description":"The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.","status":"published","published":"2024-04-11T02:15:47.79Z","modified":"2026-06-17T07:44:44.5Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-404"],"updated_at":"2026-11-02T14:09:50.299382Z"}],"osv":[{"id":"ALPINE-CVE-2024-3652","description":"The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.","status":"published","published":"2024-04-11T02:15:47.79Z","modified":"2026-11-03T06:32:45.45934052Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"CVE-2024-3652","description":"The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.","status":"published","published":"2024-04-11T02:15:47.79Z","modified":"2026-10-24T10:30:49.920838199Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:40.704083Z"},{"id":"DEBIAN-CVE-2024-3652","description":"The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.","status":"published","published":"2024-04-11T02:15:47.79Z","modified":"2026-11-06T17:28:05.462161294Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T18:00:26.717991Z"},{"id":"OESA-2024-1565","title":"libreswan security update","description":"Libreswan is an implementation of IKEv1 and IKEv2 for IPsec. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services.  These services allow you to build secure tunnels through untrusted networks.  Everything passing through the untrusted net is encrypted by the ipsec gateway machine and decrypted by the gateway at the other end of the tunnel.  The resulting tunnel is a virtual private network or VPN.\r\n\r\nSecurity Fix(es):\r\n\r\nThe Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan\u0026apos;s default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.(CVE-2024-3652)","status":"published","published":"2024-05-10T11:07:01Z","modified":"2026-08-18T01:18:25.79298684Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHBA-2024:11505","title":"Red Hat Bug Fix Advisory: OpenShift Container Platform 4.16.28 packages and security update","status":"published","published":"2025-01-14T10:10:05Z","modified":"2026-01-29T10:57:32.51331Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHBA-2024:11525","title":"Red Hat Bug Fix Advisory: OpenShift Container Platform 4.17.10 packages and security update","status":"published","published":"2025-01-09T10:07:44Z","modified":"2026-01-29T10:57:31.938371Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHBA-2024:11565","title":"Red Hat Bug Fix Advisory: OpenShift Container Platform 4.15.42 packages update","status":"published","published":"2025-01-14T10:10:06Z","modified":"2026-01-29T10:57:32.750352Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2024:4050","title":"Red Hat Security Advisory: libreswan security update","status":"published","published":"2024-09-16T19:41:51Z","modified":"2026-08-26T10:05:23Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:4200","title":"Red Hat Security Advisory: libreswan security update","status":"published","published":"2024-09-16T19:41:59Z","modified":"2026-08-26T10:05:25Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:4376","title":"Red Hat Security Advisory: libreswan security update","status":"published","published":"2024-09-16T19:42:08Z","modified":"2026-08-26T10:05:28Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:4377","title":"Red Hat Security Advisory: libreswan security update","status":"published","published":"2024-09-16T19:42:17Z","modified":"2026-08-26T10:05:29Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:4417","title":"Red Hat Security Advisory: libreswan security update","status":"published","published":"2024-09-16T19:42:25Z","modified":"2026-08-26T10:05:31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:4431","title":"Red Hat Security Advisory: libreswan security update","status":"published","published":"2024-09-16T19:42:33Z","modified":"2026-08-26T10:05:31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RLSA-2024:4376","title":"Moderate: libreswan security update","description":"Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).\n\nSecurity Fix(es):\n\n* libreswan: IKEv1 default AH/ESP responder can crash and restart (CVE-2024-3652)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-05-07T19:11:47.341314Z","modified":"2025-10-09T05:47:36.952826Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2024-3652","description":"The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.","status":"published","published":"2024-04-11T02:15:00Z","modified":"2026-10-17T12:56:37.504720157Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:50.784131Z"},{"id":"ALSA-2024:4050","title":"Moderate: libreswan security update","description":"Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).\n\nSecurity Fix(es):\n\n* libreswan: IKEv1 default AH/ESP responder can crash and restart (CVE-2024-3652)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-06-23T00:00:00Z","modified":"2026-10-29T11:32:10.050498389Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:4376","title":"Moderate: libreswan security update","description":"Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).\n\nSecurity Fix(es):\n\n* libreswan: IKEv1 default AH/ESP responder can crash and restart (CVE-2024-3652)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-07-08T00:00:00Z","modified":"2026-10-29T11:02:21.387021441Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"AZL-39919","title":"CVE-2024-3652 affecting package libreswan for versions less than 4.15-1","description":"The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.","status":"published","published":"2024-04-11T02:15:47Z","modified":"2026-04-21T04:52:39.593107Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-39927","title":"CVE-2024-3652 affecting package libreswan for versions less than 4.14-2","description":"The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.","status":"published","published":"2024-04-11T02:15:47Z","modified":"2026-04-21T04:28:52.043489Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"CLSA-2025-1752749664","title":"libreswan: Fix of CVE-2024-3652","description":"- CVE-2024-3652: fix assertion failure and crash caused by requesting AES-GMAC\n  without specifying esp= line","status":"published","published":"2025-07-17T10:54:29Z","modified":"2026-06-01T00:30:57.368692292Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"MGASA-2024-0138","title":"Updated libreswan packages fix security vulnerability","description":"CVE-2024-3652: The Libreswan Project was notified of an issue causing\nlibreswan to restart when using IKEv1 without specifying an esp= line.\nWhen the peer requests AES-GMAC, libreswan's default proposal handler\ncauses an assertion failure and crashes and restarts. IKEv2 connections\nare not affected.\n","status":"published","published":"2024-04-19T01:16:42Z","modified":"2026-04-16T04:42:26.195367549Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"RLSA-2024:4050","title":"Moderate: libreswan security update","description":"Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).\n\nSecurity Fix(es):\n\n* libreswan: IKEv1 default AH/ESP responder can crash and restart (CVE-2024-3652)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-07-02T14:11:35.145045Z","modified":"2026-02-04T15:30:17.047478Z","updated_at":"2026-11-02T15:53:24.923365Z"}]}}