8.2 High

CVE-2024-22053 A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an…

Description

A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack or in certain conditions read contents from memory.

Affected products and versions

Product	Affected versions	Fixed in
Connect Secure 22.6	earliest → < 22.6R2.3	22.6R2.3
Connect Secure 22.5	earliest → < 22.5R2.4	22.5R1.3
Connect Secure 22.4	earliest → < 22.4R2.4	22.4R1.2
Connect Secure 22.3	earliest → < 22.3R1.2	22.3R1.2
Connect Secure 22.2	earliest → < 22.2R4.2	22.2R4.2
Connect Secure 22.1	earliest → < 22.1R6.2	22.1R6.2
Connect Secure 9.1	earliest → < 9.1R18.5	9.1R14.6
Policy Secure 22.6	earliest → < 22.6R1.2	22.6R1.2
Policy Secure 22.5	earliest → < 22.5R1.3	22.5R1.3

Show the 13 other branches

Product	Affected versions	Fixed in
Policy Secure 22.4	earliest → < 22.4R1.2	22.4R1.2
Policy Secure 9.1	earliest → < 9.1R18.5	9.1R16.4
connect_secure 22.6	22.6R1.2 → 22.6R2.3	No fix stated
connect_secure 22.5	22.5R1.3 → 22.5R2.4	No fix stated
connect_secure 22.4	22.4R1.2 → 22.4R2.4	No fix stated
connect_secure	22.3R1.2	No fix stated
connect_secure 22.2	22.2R3 → 22.2R4.2	No fix stated
connect_secure	22.1R6.2	No fix stated
connect_secure 9.1	9.1R14.6 → 9.1R18.5	No fix stated
policy_secure	22.6R1.2	No fix stated
policy_secure	22.5R1.3	No fix stated
policy_secure	22.4R1.2	No fix stated
policy_secure 9.1	9.1R16.4 → 9.1R18.5	No fix stated