Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-4068
Advisory Released Date: 2026-10-30
Advisory Updated Date: 2026-11-02
In Libreswan before 5.3.2, when the operating system and Libreswan are running in FIPS mode and at least one CA certificate is loaded, a malformed X.509 certificate payload can cause the pluto daemon to abort on an assertion. In FIPS mode, add_decoded_cert() calls CERT_ExtractPublicKey() and asserts the result is non-NULL, but the function returns NULL when public key extraction fails (for example when the RSA exponent is 0), triggering the assertion failure. A remote, unauthenticated attacker can send such a corrupt CERT payload (over IKEv1 or IKEv2) before authentication completes, crashing and restarting the daemon; repeated sending causes a sustained denial of service. Remote code execution is not possible. Versions 3.0 through 5.3.1 are affected. (CVE-2026-14957)
Affected Packages:
libreswan
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update libreswan or yum update --advisory ALAS2-2026-4068 to update your system.
aarch64:
libreswan-3.25-4.8.amzn2.0.5.aarch64
libreswan-debuginfo-3.25-4.8.amzn2.0.5.aarch64
i686:
libreswan-3.25-4.8.amzn2.0.5.i686
libreswan-debuginfo-3.25-4.8.amzn2.0.5.i686
src:
libreswan-3.25-4.8.amzn2.0.5.src
x86_64:
libreswan-3.25-4.8.amzn2.0.5.x86_64
libreswan-debuginfo-3.25-4.8.amzn2.0.5.x86_64