PT-2019-15145 · Oisf+1 · Suricata+2

Ajaxtpm · Published 2019-10-09 · Updated 2021-07-21 · CVE-2019-17420

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OISF LibHTP versions prior to 0.5.31 Suricata version 4.1.4

Description An HTTP protocol parsing error occurs in the affected software, causing the http header signature to not alert on a response with a single r ending.

Recommendations For OISF LibHTP versions prior to 0.5.31, update to version 0.5.31 or later to resolve the issue. For Suricata version 4.1.4, consider updating to a newer version that incorporates the fix for OISF LibHTP.

Fix

Weakness Enumeration

CWE-459

Related Identifiers

ALT-PU-2020-3131

ALT-PU-2020-3170

ALT-PU-2021-2055

CVE-2019-17420

Affected Products

Alt Linux

Libhtp

Suricata

References · 10

• https://github.com/OISF/libhtp/compare/0.5.30...0.5.31 · Patch
• https://github.com/OISF/libhtp/pull/213 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-17420 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-17420 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17420 · Vendor Advisory
• https://redmine.openinfosecfoundation.org/issues/2969 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17420 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17420 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-17420 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-17420 · Security Note