Amazon Linux 2023 Security Advisory: ALAS2023-2026-3253
Advisory Released Date: 2026-10-24
Advisory Updated Date: 2026-10-26
A null pointer dereference flaw was found in Libreswan's PKCS#7 certificate payload handling. When processing a crafted IKEv2 IKE_AUTH packet containing a PKCS#7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash and restart. A remote, unauthenticated attacker could repeatedly trigger this flaw to cause a denial of service. (CVE-2026-77207)
A use-after-free flaw was found in Libreswan's IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this flaw to cause the pluto daemon to crash and restart, resulting in denial of service. (CVE-2026-94453)
Affected Packages:
libreswan
Issue Correction:
Run dnf update libreswan --releasever 2023.12.20261026 or dnf update --advisory ALAS2023-2026-3253 --releasever 2023.12.20261026 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
libreswan-debuginfo-4.12-3.amzn2023.0.4.aarch64
libreswan-4.12-3.amzn2023.0.4.aarch64
libreswan-debugsource-4.12-3.amzn2023.0.4.aarch64
src:
libreswan-4.12-3.amzn2023.0.4.src
x86_64:
libreswan-4.12-3.amzn2023.0.4.x86_64
libreswan-debugsource-4.12-3.amzn2023.0.4.x86_64
libreswan-debuginfo-4.12-3.amzn2023.0.4.x86_64