DEBIAN-CVE-2018-5389

    Dashboard / Vulnerabilities / DEBIAN-CVE-2018-5389

    DEBIAN-CVE-2018-5389

    Published: 6 Sept 2018Last Modified: 1 Sept 2026
    Upstream:
    CVE-2018-5389

    Summary:

    Details: The Internet Key Exchange v1 main mode is vulnerable to offline dictionary or brute force attacks. Reusing a key pair across different versions and modes of IKE could lead to cross-protocol authentication bypasses. It is well known, that the aggressive mode of IKEv1 PSK is vulnerable to offline dictionary or brute force attacks. For the main mode, however, only an online attack against PSK authentication was thought to be feasible. This vulnerability could allow an attacker to recover a weak Pre-Shared Key or enable the impersonation of a victim host or network.

    References: https://security-tracker.debian.org/tracker/CVE-2018-5389

    Affected packages

    Package

    Name: libreswan

    Purl: pkg:deb/debian/libreswan?arch=source&distro=bookworm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    4.10-2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High