Red Hat Libreswan Update Fixes Four RHEL 8 Network Flaws
Tech GuruQuick Answer
RHEL 8.8 E4S and TUS systems have a Libreswan fix in 4.9-3.el8_8.3. The four listed flaws include remote denial of service; authentication bypass depends on specific weak-RSA conditions. Match your IKE mode, certificates and policy to the individual CVEs before judging exposure.
Confirm Scope And Apply The Supported Fix
Next step: Plan the VPN update with a management path that does not depend on the tunnel being changed. Check peer compatibility and update from the entitled RHEL 8.8 repository.
Last verified: 2026-09-28 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | RHEL 8.8 E4S and TUS libreswan packages before 4.9-3.el8_8.3 |
|---|---|
| Advisory | RHSA-2026:72287 |
| CVEs | CVE-2026-12413, CVE-2026-14957, CVE-2026-50721, CVE-2026-50722 |
| Authoritative release date | RHSA-2026:72287: 2026-09-28 03:06:08 UTC |
| Authority revision date | RHSA-2026:72287: 2026-09-28 03:29:51 UTC |
| Affected versions | Entitled RHEL 8.8 Update Services for SAP Solutions and Telecommunications Update Service systems using libreswan before 4.9-3.el8_8.3. |
| Fixed version | libreswan 4.9-3.el8_8.3 |
| CVSS base score | 7.5 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The mechanisms include malformed IKE fragments, certificate handling in FIPS mode, and RSA authentication processing. Red Hat describes possible signature forgery with weak public exponents for the relevant authentication flaws. Do not turn that conditional impact into a claim that every IPsec tunnel is bypassable.
What To Validate Now
- Inventory. Locate RHEL 8.8 E4S and TUS libreswan packages before 4.9-3.el8_8.3 deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: Entitled RHEL 8.8 Update Services for SAP Solutions and Telecommunications Update Service systems using libreswan before 4.9-3.el8_8.3. Do not infer applicability from product family or severity alone.
- Remediate. Apply libreswan 4.9-3.el8_8.3 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the running Libreswan build, establish representative tunnels, exercise rekeying, and verify traffic selectors and expected denial of unauthorized peers. Check failover and logs with secrets redacted. Do not disable certificate validation merely to make a post-update connection succeed.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
