{
  "threat_severity" : "Moderate",
  "public_date" : "2023-02-21T00:00:00Z",
  "bugzilla" : {
    "description" : "libreswan: remote DoS via crafted TS payload with an incorrect selector length",
    "id" : "2173610",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2173610"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-20",
  "details" : [ "Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length.", "A flaw was found in the Libreswan package. A crafted TS payload with an incorrect selector length may allow a remote attacker to cause a denial of service." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2023-05-16T00:00:00Z",
    "advisory" : "RHSA-2023:3095",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "libreswan-0:4.9-2.el8_8.2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-05-09T00:00:00Z",
    "advisory" : "RHSA-2023:2633",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "libreswan-0:4.9-2.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2024-12-02T00:00:00Z",
    "advisory" : "RHSA-2024:10594",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0",
    "package" : "libreswan-0:4.6-3.el9_0.3"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.15",
    "release_date" : "2025-01-02T00:00:00Z",
    "advisory" : "RHBA-2024:11565",
    "cpe" : "cpe:/a:redhat:openshift:4.15::el9",
    "package" : "libreswan-0:4.6-3.el9_0.3"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.16",
    "release_date" : "2025-01-02T00:00:00Z",
    "advisory" : "RHBA-2024:11505",
    "cpe" : "cpe:/a:redhat:openshift:4.16::el9",
    "package" : "libreswan-0:4.6-3.el9_0.3"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.17",
    "release_date" : "2025-01-02T00:00:00Z",
    "advisory" : "RHBA-2024:11525",
    "cpe" : "cpe:/a:redhat:openshift:4.17::el9",
    "package" : "libreswan-0:4.6-3.el9_0.3"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "libreswan",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-23009\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-23009\nhttps://github.com/libreswan/libreswan/issues/954" ],
  "name" : "CVE-2023-23009",
  "csaw" : false
}