PT-2019-4779 · Openconnect+3 · Openconnect+3

Lukas Kupczyk · Published 2019-09-17 · Updated 2024-12-25 · CVE-2019-16239

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenConnect versions prior to 8.05

Description The issue is related to a buffer overflow in the process http response function when handling HTTP chunked encoding with crafted chunk sizes. This could allow a remote attacker to gain unauthorized access to information and impact its integrity and availability.

Recommendations For versions prior to 8.05, update to version 8.05 or later to resolve the issue. As a temporary workaround, consider restricting access to the process http response function until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

ALT-PU-2019-2773

ALT-PU-2024-17486

ALT-PU-2024-17686

BDU:2020-01355

CVE-2019-16239

DLA-1945-1

DSA-4607-1

MGASA-2020-0005

OPENSUSE-SU-2019:2385-1

OPENSUSE-SU-2019:2388-1

OPENSUSE-SU-2019_2385-1

OPENSUSE-SU-2019_2388-1

OPENSUSE-SU-2024:13322-1

SUSE-SU-2019:2737-1

SUSE-SU-2019:2744-1

SUSE-SU-2019:2744-2

SUSE-SU-2019_2737-1

SUSE-SU-2019_2744-1

USN-4565-1

Affected Products

Alt Linux

Openconnect

Suse

Ubuntu

References · 61

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDMZGNBLZZKAGBI2PNXYWWKLD2LXKFH6 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2744-1 · Vendor Advisory
• https://usn.ubuntu.com/4565-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16239 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WI7ZENFAWCHF2RU4NHPL2CU4WGZ4BNDJ · Vendor Advisory
• https://osv.dev/vulnerability/USN-4565-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2388-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FX56KYWC7X4ETV4P6HGJC7GZUEBITBBS · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-16239 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-1945-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07616 · Security Note
• https://osv.dev/vulnerability/DSA-4607-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16239 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:2744-2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01355 · Security Note