PT-2023-10803 · Unknown+1 · Flar2 Elementalx+1

Mohamed Ghannam · Published 2023-01-01 · Updated 2024-05-17 · CVE-2018-25062

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions flar2 ElementalX versions up to 6.x

Description A problematic vulnerability has been found, affecting the function xfrm dump policy done of the file net/xfrm/xfrm user.c of the component ipsec. The manipulation leads to denial of service.

Recommendations For flar2 ElementalX versions up to 6.x, upgrade to version 7.00 to address this issue. As a temporary workaround, consider disabling the xfrm dump policy done function until the patch is applied. Restrict access to the ipsec component to minimize the risk of exploitation.

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2018-25062

Affected Products

Flar2 Elementalx

Ipsec

References · 7

• https://github.com/flar2/ElementalX-N9/commit/1df72c9f0f61304437f4f1037df03b5fb36d5a79 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-25062 · Security Note
• https://osv.dev/vulnerability/CVE-2018-25062 · Vendor Advisory
• https://vuldb.com/?ctiid.217152 · Note
• https://t.me/cibsecurity/55716 · Telegram Post
• https://t.me/cvenotify/41097 · Telegram Post
• https://vuldb.com/?id.217152 · Note