CVE-2019-12312

Name	CVE-2019-12312
Description	In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	929916

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libreswan (PTS)	buster (security), buster, buster (lts)	3.27-6+deb10u1	fixed
	bullseye	4.3-1+deb11u4	fixed
	bullseye (security)	4.3-1+deb11u3	fixed
	bookworm	4.10-2+deb12u1	fixed
	sid, trixie	4.14-1.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libreswan	source	experimental	3.28-1
libreswan	source	(unstable)	3.27-5			929916

Notes

https://github.com/libreswan/libreswan/issues/246
https://github.com/libreswan/libreswan/commit/7142d2c37d58cf024595a7549f0fb0d3946682f8
https://libreswan.org/security/CVE-2019-12312/CVE-2019-12312.txt
https://libreswan.org/security/CVE-2019-12312/libreswan-3.27-CVE-2019-12312.patch