PT-2019-17502 · Libev+1 · Shadowsocks-Libev+1

Published 2019-12-18 · Updated 2022-06-17 · CVE-2019-5152

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Shadowsocks-libev version 3.3.2

Description An exploitable information disclosure issue exists in the network packet handling functionality. When utilizing a Stream Cipher, a specially crafted set of network packets can cause an outbound connection from the server, resulting in information disclosure. An attacker can send arbitrary packets to trigger this issue.

Recommendations For Shadowsocks-libev version 3.3.2, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-5152

Affected Products

Debian

Shadowsocks-Libev

References · 14

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0942 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2019-5152 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-5152 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5152 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-5152 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5152 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-5152 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-5152 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-5152 · Security Note
• https://security-tracker.debian.org/tracker/source-package/shadowsocks-libev · Vendor Advisory
• https://github.com/shadowsocks/shadowsocks-libev/issues/2525#issuecomment-557551274 · Note
• https://github.com/shadowsocks/shadowsocks-libev/issues/2525 · Note
• https://t.me/cvenotify/31774 · Telegram Post
• https://packages.debian.org/src:shadowsocks-libev · Note