Amazon Linux 2023 Security Advisory: ALAS2023-2026-3377
Advisory Released Date: 2026-11-09
Advisory Updated Date: 2026-11-09
In Libreswan before 5.3.2, when the operating system and Libreswan are running in FIPS mode and at least one CA certificate is loaded, a malformed X.509 certificate payload can cause the pluto daemon to abort on an assertion. In FIPS mode, add_decoded_cert() calls CERT_ExtractPublicKey() and asserts the result is non-NULL, but the function returns NULL when public key extraction fails (for example when the RSA exponent is 0), triggering the assertion failure. A remote, unauthenticated attacker can send such a corrupt CERT payload (over IKEv1 or IKEv2) before authentication completes, crashing and restarting the daemon; repeated sending causes a sustained denial of service. Remote code execution is not possible. Versions 3.0 through 5.3.1 are affected. (CVE-2026-14957)
Affected Packages:
libreswan
Issue Correction:
Run dnf update libreswan --releasever 2023.12.20261109 or dnf update --advisory ALAS2023-2026-3377 --releasever 2023.12.20261109 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
libreswan-debuginfo-4.12-3.amzn2023.0.5.aarch64
libreswan-4.12-3.amzn2023.0.5.aarch64
libreswan-debugsource-4.12-3.amzn2023.0.5.aarch64
src:
libreswan-4.12-3.amzn2023.0.5.src
x86_64:
libreswan-4.12-3.amzn2023.0.5.x86_64
libreswan-debuginfo-4.12-3.amzn2023.0.5.x86_64
libreswan-debugsource-4.12-3.amzn2023.0.5.x86_64