CVE-2026-50722
HighCVSS 8.1Summary
In Libreswan, the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa() incorrectly verifies the DER encoding of the ASN.1 digest when processing IKEv2 AUTH payloads using RSASSA-PKCS1-v1_5. A remote attacker can exploit a Bleichenbacher-style attack to forge the AUTH payload when small public exponents (e.g., e=3) are used, leading to impersonation. Additionally, encoding a shorter-than-expected hash in the AUTH payload can trigger an assertion causing denial-of-service.
Risk Assessment
The risk includes remote impersonation of legitimate users or devices and denial-of-service (DoS) attacks by repeatedly triggering assertions that restart the daemon. This can disrupt VPN communication and compromise authentication integrity.
Recommendation
Immediately update Libreswan to a version that fixes the DER encoding verification in RSA_authenticate_hash_signature_pkcs1_1_5_rsa(). Until patched, avoid using small public exponents (e.g., e=3) in certificates and monitor logs for malformed AUTH payloads.
Original NVD description (English source)
Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.