CVE-2019-10155

LowCVSS 3.1/10Last modified Jun 17, 2026

Description

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-354

Affected software

Vendor	Product	Versions
the libreswan Project	libreswan	3.29

References

https://access.redhat.com/errata/RHSA-2019:3391Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10155Issue Tracking, Patch, Third Party Advisory
https://libreswan.org/security/CVE-2019-10155/Patch, Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUEXFCN7FAYBKJBQJLYCEUQUCHDEJRZW/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFGPGLLKAXSLWFI62A6BZHTZSCHRCBXS/
https://access.redhat.com/errata/RHSA-2019:3391Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10155Issue Tracking, Patch, Third Party Advisory
https://libreswan.org/security/CVE-2019-10155/Patch, Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUEXFCN7FAYBKJBQJLYCEUQUCHDEJRZW/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFGPGLLKAXSLWFI62A6BZHTZSCHRCBXS/

Timeline

Published: Jun 12, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-101565.4A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of CVE-2019-101575.5It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its back CVE-2019-101589.8A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Ses CVE-2019-101594.3cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration CVE-2019-10164.7An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker w CVE-2019-101609.8A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7 CVE-2019-101617.8It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() AP CVE-2019-101627.5A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the serve CVE-2019-101634.3A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authorized master server to CVE-2019-101648.8PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user c CVE-2019-101652.3OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenS CVE-2019-101667.8It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainMana