GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

RHSA-2026:57741

Vulnerability from csaf_opensuse - Published: 2026-08-20 00:00 - Updated: 2026-09-16 18:45
Summary
security update for libreswan
Severity
Important
Notes
Title of the patch: security update for libreswan
Description of the patch: This security update provides a functional equivalent of RHSA-2026:57741. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:57741.
Patchnames: RHSA-2026:57741
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-12413
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Liberty Linux 9:libreswan-4.15-8.el9_6.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-14957
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 1 product, the same list as for CVE-2026-12413
Threats
Impact important
CVE-2026-50721
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 1 product, the same list as for CVE-2026-12413
Threats
Impact important
CVE-2026-50722
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 1 product, the same list as for CVE-2026-12413
Threats
Impact important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for libreswan",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2026:57741.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:57741.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2026:57741",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_57741.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2026:57741",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007562.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2026:57741",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007562.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-12413 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-12413/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-14957 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-14957/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-50721 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-50721/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-50722 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-50722/"
      }
    ],
    "title": "security update for libreswan",
    "tracking": {
      "current_release_date": "2026-09-16T18:45:58Z",
      "generator": {
        "date": "2026-08-20T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2026:57741",
      "initial_release_date": "2026-08-20T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-08-20T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T18:03:38Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T18:45:58Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libreswan-4.15-8.el9_6.1.x86_64",
                "product": {
                  "name": "libreswan-4.15-8.el9_6.1.x86_64",
                  "product_id": "libreswan-4.15-8.el9_6.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libreswan@4.15-8.el9_6.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 9",
                "product": {
                  "name": "SUSE Liberty Linux 9",
                  "product_id": "SUSE Liberty Linux 9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-4.15-8.el9_6.1.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:libreswan-4.15-8.el9_6.1.x86_64"
        },
        "product_reference": "libreswan-4.15-8.el9_6.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-12413",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-12413"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md-\u003edigest_roof \u003c elemsof(md-\u003edigest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:libreswan-4.15-8.el9_6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-12413",
          "url": "https://www.suse.com/security/cve/CVE-2026-12413"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:libreswan-4.15-8.el9_6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-20T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-12413"
    },
    {
      "cve": "CVE-2026-14957",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-14957"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In FIPS mode, Libreswan\u0027s add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate in a CERT payload to trigger the assertion, causing the pluto daemon to abort and restart. Continued exploitation causes a denial of service. No remote code execution is possible. Both IKEv1 and IKEv2 are affected. The vulnerability is only exploitable when both the OS and libreswan are running in FIPS mode and at least one CA certificate is loaded. The CERT payload is processed before peer authentication, so no credentials are needed to exploit this. Configurations using only PreSharedKey (PSK) authentication with no CA certificates loaded in the NSS database are not vulnerable.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:libreswan-4.15-8.el9_6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-14957",
          "url": "https://www.suse.com/security/cve/CVE-2026-14957"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:libreswan-4.15-8.el9_6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:libreswan-4.15-8.el9_6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-20T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-14957"
    },
    {
      "cve": "CVE-2026-50721",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-50721"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:libreswan-4.15-8.el9_6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-50721",
          "url": "https://www.suse.com/security/cve/CVE-2026-50721"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:libreswan-4.15-8.el9_6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:libreswan-4.15-8.el9_6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-20T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-50721"
    },
    {
      "cve": "CVE-2026-50722",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-50722"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:libreswan-4.15-8.el9_6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-50722",
          "url": "https://www.suse.com/security/cve/CVE-2026-50722"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:libreswan-4.15-8.el9_6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:libreswan-4.15-8.el9_6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-20T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-50722"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.