{ "document": { "aggregate_severity": { "text": "Moderate" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/vex/2023/cve-2023-38710-els_os-almalinux9_2esu.json" } ], "tracking": { "current_release_date": "2026-04-14T08:36:12Z", "generator": { "date": "2026-04-14T08:36:12Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2023-38710-ELS_OS-ALMALINUX9.2ESU", "initial_release_date": "2023-08-25T21:15:00Z", "revision_history": [ { "date": "2023-08-25T21:15:00Z", "number": "1", "summary": "Initial version" }, { "date": "2025-09-15T14:44:20Z", "number": "2", "summary": "Official Publication" }, { "date": "2025-12-23T19:08:30Z", "number": "3", "summary": "Update document" }, { "date": "2026-02-16T09:38:24Z", "number": "4", "summary": "Update document" }, { "date": "2026-04-14T08:36:12Z", "number": "5", "summary": "Update document" } ], "status": "final", "version": "5" }, "title": "Security update on CVE-2023-38710" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "libreswan-0:4.9-4.el9_2.x86_64", "product": { "name": "libreswan-0:4.9-4.el9_2.x86_64", "product_id": "libreswan-0:4.9-4.el9_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/almalinux/libreswan@4.9-4.el9_2?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "AlmaLinux 9.2", "product": { "name": "AlmaLinux 9.2", "product_id": "AlmaLinux-9.2", "product_identification_helper": { "cpe": "cpe:2.3:o:almalinux:almalinux:9.2:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "AlmaLinux" } ], "category": "vendor", "name": "AlmaLinux OS Foundation" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "libreswan-0:4.9-4.el9_2.tuxcare.els3.x86_64", "product": { "name": "libreswan-0:4.9-4.el9_2.tuxcare.els3.x86_64", "product_id": "libreswan-0:4.9-4.el9_2.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/libreswan@4.9-4.el9_2.tuxcare.els3?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libreswan-0:4.9-4.el9_2.tuxcare.els3.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:libreswan-0:4.9-4.el9_2.tuxcare.els3.x86_64" }, "product_reference": "libreswan-0:4.9-4.el9_2.tuxcare.els3.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "libreswan-0:4.9-4.el9_2.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:libreswan-0:4.9-4.el9_2.x86_64" }, "product_reference": "libreswan-0:4.9-4.el9_2.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-38710", "notes": [ { "category": "description", "text": "An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent back. The notify payload's protocol ID is copied from the incoming packet, but the code that verifies outgoing packets fails an assertion that the protocol ID must be ESP (2) or AH(3) and causes the pluto daemon to crash and restart. NOTE: the earliest affected version is 3.20.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.2:libreswan-0:4.9-4.el9_2.tuxcare.els3.x86_64" ], "known_affected": [ "AlmaLinux-9.2:libreswan-0:4.9-4.el9_2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-38710" }, { "category": "external", "summary": "https://github.com/libreswan/libreswan/tags", "url": "https://github.com/libreswan/libreswan/tags" }, { "category": "external", "summary": "https://libreswan.org/security/CVE-2023-38710/", "url": "https://libreswan.org/security/CVE-2023-38710/" } ], "release_date": "2023-08-25T21:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2025-09-15T14:43:51.458477Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2025:1757947429", "product_ids": [ "AlmaLinux-9.2:libreswan-0:4.9-4.el9_2.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2025:1757947429" }, { "category": "none_available", "details": "Affected", "product_ids": [ "AlmaLinux-9.2:libreswan-0:4.9-4.el9_2.x86_64" ] }, { "category": "vendor_fix", "date": "2025-09-15T14:43:51.458477Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2025:1757947429", "product_ids": [ "AlmaLinux-9.2:libreswan-0:4.9-4.el9_2.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2025:1757947429" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.2:libreswan-0:4.9-4.el9_2.tuxcare.els3.x86_64", "AlmaLinux-9.2:libreswan-0:4.9-4.el9_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }