PT-2018-12583 · Open Information Security Foundation+1 · Suricata+1

Ajaxtpm · Published 2018-07-23 · Updated 2025-07-28 · CVE-2018-14568

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 4.0.5

Description The issue allows for detection bypass due to the way Suricata handles TCP RST packets from servers. Specifically, when a TCP RST is received from a server, Suricata stops inspecting the TCP stream. However, Windows TCP clients continue processing TCP data that arrives shortly after the RST as if the RST had not been received. This discrepancy enables potential bypass of detection mechanisms.

Recommendations For Suricata versions prior to 4.0.5, update to version 4.0.5 or later to resolve the issue.

Exploit

Fix

Related Identifiers

ALT-PU-2020-3551

ALT-PU-2021-2056

CVE-2018-14568

OPENSUSE-SU-2025:15394-1

Affected Products

Alt Linux

Suricata

References · 42

• 🔥 https://github.com/kirillwow/ids_bypass · Exploit
• 🔥 https://redmine.openinfosecfoundation.org/issues/2501 · Exploit
• https://github.com/OISF/suricata/pull/3428/commits/843d0b7a10bb45627f94764a6c5d468a24143345 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2025:15394-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-14568 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-14568 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-14568 · Vendor Advisory
• https://suricata-ids.org/2018/07/18/suricata-4-0-5-available · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14568 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-14568 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14568 · Security Note
• https://ubuntu.com/security/CVE-2018-14568 · Vendor Advisory
• https://suse.com/security/cve/CVE-2024-47522 · Note
• https://suse.com/security/cve/CVE-2024-38534 · Note
• https://suse.com/security/cve/CVE-2024-47187 · Note