CVE-2018-5389

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2018-5389
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-5389.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-5389
Related
Published
2018-09-06T21:29:00Z
Modified
2025-01-14T07:33:53.670679Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

The Internet Key Exchange v1 main mode is vulnerable to offline dictionary or brute force attacks. Reusing a key pair across different versions and modes of IKE could lead to cross-protocol authentication bypasses. It is well known, that the aggressive mode of IKEv1 PSK is vulnerable to offline dictionary or brute force attacks. For the main mode, however, only an online attack against PSK authentication was thought to be feasible. This vulnerability could allow an attacker to recover a weak Pre-Shared Key or enable the impersonation of a victim host or network.

References

Affected packages

Debian:11 / libreswan

Package

Name
libreswan
Purl
pkg:deb/debian/libreswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.3-1
4.3-1+deb11u1
4.3-1+deb11u3
4.3-1+deb11u4
4.5-1
4.5-2
4.6-1
4.7-1
4.9-1
4.9-2
4.10-1
4.10-2
4.11-1
4.12-1
4.12-2
4.12-3
4.14-1
4.14-1.1

5.*

5.0~rc2-1
5.0~rc2-2

Ecosystem specific 

{
    "urgency": "unimportant"
}

Debian:12 / libreswan

Package

Name
libreswan
Purl
pkg:deb/debian/libreswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.10-2
4.10-2+deb12u1
4.11-1
4.12-1
4.12-2
4.12-3
4.14-1
4.14-1.1

5.*

5.0~rc2-1
5.0~rc2-2

Ecosystem specific 

{
    "urgency": "unimportant"
}

Debian:13 / libreswan

Package

Name
libreswan
Purl
pkg:deb/debian/libreswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.10-2
4.11-1
4.12-1
4.12-2
4.12-3
4.14-1
4.14-1.1

5.*

5.0~rc2-1
5.0~rc2-2

Ecosystem specific 

{
    "urgency": "unimportant"
}

Debian:11 / strongswan

Package

Name
strongswan
Purl
pkg:deb/debian/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.9.1-1
5.9.1-1+deb11u1
5.9.1-1+deb11u2
5.9.1-1+deb11u3
5.9.1-1+deb11u4
5.9.4-1
5.9.5-1
5.9.5-2
5.9.6-1
5.9.8-1
5.9.8-2
5.9.8-3
5.9.8-4
5.9.8-5
5.9.11-1
5.9.11-2
5.9.12-1
5.9.13-1
5.9.13-2

Ecosystem specific 

{
    "urgency": "unimportant"
}

Debian:12 / strongswan

Package

Name
strongswan
Purl
pkg:deb/debian/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.9.8-5
5.9.8-5+deb12u1
5.9.11-1
5.9.11-2
5.9.12-1
5.9.13-1
5.9.13-2

Ecosystem specific 

{
    "urgency": "unimportant"
}

Debian:13 / strongswan

Package

Name
strongswan
Purl
pkg:deb/debian/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.9.8-5
5.9.11-1
5.9.11-2
5.9.12-1
5.9.13-1
5.9.13-2

Ecosystem specific 

{
    "urgency": "unimportant"
}