PT-2019-17502 · Libev+1 · Shadowsocks-Libev+1

Publicado 2019-12-18 · Atualizado 2022-06-17 · CVE-2019-5152

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Shadowsocks-libev version 3.3.2

Description An exploitable information disclosure issue exists in the network packet handling functionality. When utilizing a Stream Cipher, a specially crafted set of network packets can cause an outbound connection from the server, resulting in information disclosure. An attacker can send arbitrary packets to trigger this issue.

Recommendations For Shadowsocks-libev version 3.3.2, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2019-5152

Produtos afetados

Debian

Shadowsocks-Libev

Referências · 14

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0942 · Exploit
• https://github.com/shadowsocks/shadowsocks-libev/issues/2525#issuecomment-557551274 · Nota
• https://github.com/shadowsocks/shadowsocks-libev/issues/2525 · Nota
• https://security-tracker.debian.org/tracker/CVE-2019-5152 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-5152 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5152 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-5152 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5152 · Nota de Segurança
• https://t.me/cvenotify/31774 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-5152 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-5152 · Aviso do Fabricante
• https://packages.debian.org/src:shadowsocks-libev · Nota
• https://cve.org/CVERecord?id=CVE-2019-5152 · Nota de Segurança
• https://security-tracker.debian.org/tracker/source-package/shadowsocks-libev · Aviso do Fabricante