* Sat Jun 22 2024 Paul Wouters <paul.wouters@aiven.io> – 4.15-2
– Add libreswan-4.15-ipsec_import.patch
* Sat Jun 22 2024 Paul Wouters <paul.wouters@aiven.io> – 4.15-1
– Update libreswan to 4.15 for CVE-2024-3652
– Resolves rhbz#2274448 CVE-2024-3652 libreswan: IKEv1 default AH/ESP
responder can crash and restart
– Allow “ipsec import” to try importing PKCS#12 non-interactively if there
is no password
What is the attack?FortiGuard Labs’ Recon team is aware of communications on a cybercrime forum known as ‘BreachForums’ with a Threat Actor (TA) known by the alias ‘IntelBroker.’ This threat actor has posted about selling access to various internal resources of several undisclosed organizations. The Threat Actor (TA) claimed to have acquired access to the sensitive information by breaching a single, unnamed company that provides services to over 400 organizations, primarily in the US. The TA disclosed a list of over 400 organizations compromised. Based on this information and active exploitations, the FortiRecon team has ascertained that several of the compromised organizations are customers/clients of MSP Cprime’s services and suspect an attack through their infrastructure to be the source of the attack.What is the recommended Mitigation?At this point, it is unclear what the attack vector into the MSP network was, or how onward access was gained into the victim organization network however; there have been mentions of access being gained to Github, Jira, and Confluence instances. At this point, Fortinet recommends increased vigilance to identify any unusual network or server activity. Fortinet customers could use FortiRecon’s Digital Risk Protection (DRP) service to help counter attacks at the reconnaissance phase and significantly reduce the risk, time, and cost of later-stage threat mitigation. https://www.fortinet.com/products/fortirecon What FortiGuard Coverage is available?FortiGuard Labs’ research team is currently investigating and monitoring this situation closely and will provide more information as it becomes available. FortiGuard Incident Response team can be engaged to help with any suspected compromise.
Update to upstream OpenVPN 2.6.11
CVE-2024-5594: control channel: refuse control channel messages with nonprintable characters in them
CVE-2024-28882: only call schedule_exit() once (on a given peer)
