PT-2020-9705 · Linbit+2 · Csync2+2

Published 2020-03-20 · Updated 2024-12-25 · CVE-2019-15522

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LINBIT csync2 versions through 2.0

Description An issue was discovered in LINBIT csync2 where the csync daemon session in daemon.c neglects to force a failure of a hello command when the configuration requires use of SSL.

Recommendations For versions through 2.0, as a temporary workaround, consider disabling the csync daemon session function until a patch is available. Restrict access to the daemon.c module to minimize the risk of exploitation. Avoid using the SSL configuration in the affected csync2 until the issue is resolved.

Fix

Related Identifiers

ALT-PU-2023-7630

ALT-PU-2023-7632

ALT-PU-2023-7754

ALT-PU-2024-17519

CVE-2019-15522

OPENSUSE-SU-2021:0853-1

OPENSUSE-SU-2021_0853-1

OPENSUSE-SU-2024:10706-1

SUSE-SU-2021:14763-1

SUSE-SU-2021:1858-1

SUSE-SU-2021:1952-1

SUSE-SU-2021_14763-1

SUSE-SU-2021_1858-1

SUSE-SU-2021_1952-1

Affected Products

Alt Linux

Suse

Csync2

References · 24

• https://github.com/LINBIT/csync2/commit/416f1de878ef97e27e27508914f7ba8599a0be22 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-15522 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-15522 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15522 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-15522 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:1858-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-15522 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15522 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2021:0853-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15522 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:14763-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10706-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1952-1 · Vendor Advisory
• https://github.com/LINBIT/csync2/pull/13/commits/0ecfc333da51575f188dd7cf6ac4974d13a800b1 · Note
• https://bugzilla.suse.com/1147137 · Note