RHBA-2019:0490 - Bug Fix Advisory

Topic

Updated libreswan packages that fix several bugs are now available for Red Hat Enterprise Linux 7.5 Extended Update Support.

Description

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

This update fixes the following bugs:

• Prior to this update, Libreswan could use deleted objects while printing errors and it also did not properly fail when the AES key size was less than 128 bits. As a consequence, the pluto daemon crashed on assertion failed when the IPsec initiator sent "OAKLEY_KEY_LENGTH == 0 (0x00)" for the AES_CBC encryption algorithm. The error printing has been simplified and the AES key size check has been added to an earlier phase. As a result, Libreswan now correctly handles the described scenario. (BZ#1660535)
• Previously, Libreswan continued to process an IKEv1 packet after it had already processed a delete payload. Consequently, Libreswan had deleted the IKE session state, then tried to read the next payload from that deleted state and crashed. The handling of such packets has been fixed, and Libreswan now correctly stops processing payloads once it processes a delete payload. (BZ#1660541)
• Previously, Libreswan incorrectly passed the zero-length IKEv1 XAUTH password as NULL to the crypt() function. Consequently, Libreswan crashed with the "strncpy(): /usr/libexec/ipsec/pluto killed by 11" message. This has been fixed, and Libreswan now processes IKEv1 empty passwords correctly. (BZ#1664047)

Users of libreswan are advised to upgrade to these updated packages, which fix these bugs.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le

Fixes

• BZ - 1664047 - [abrt] [faf] libreswan: strncpy(): /usr/libexec/ipsec/pluto killed by 11 [rhel-7.5.z]

CVEs

(none)

References

(none)