Executive brief
Libreswan is a widely used tool for establishing secure VPN connections. A vulnerability in how it handles certain cryptographic signatures allows a remote attacker to potentially bypass authentication or crash the service. This could lead to unauthorized access to the private network or a total loss of VPN connectivity for users.
Technical details
A vulnerability exists in the RSA_authenticate_hash_signature_pkcs1_1_5_rsa() function due to improper verification of the DER encoding of the ASN.1 digest in IKEv2 AUTH payloads. When RSASSA-PKCS1-v1_5 is used with small public exponents (e.g., e=3), a remote attacker can perform a Bleichenbacher-style attack to forge signatures and impersonate a peer. Additionally, providing a shorter-than-expected hash in the AUTH payload triggers a reachable assertion, causing the daemon to abort and restart, leading to a denial-of-service. This issue is fixed in Libreswan version 5.3.1.
Affected products
- The Libreswan Project libreswan <= 5.3
Timeline
- 2026-03-24: disclosed: Libreswan notified of the issue
- 2026-06-16: other: Advanced notice given to customers and distributions
- 2026-06-24: patched: Public announcement and release of version 5.3.1
- 2026-07-02: advisory: NVD publication date