PT-2020-9706 · Linbit+2 · Linbit Csync2+2

Published 2020-12-30 · Updated 2024-12-25 · CVE-2019-15523

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions LINBIT csync2 versions through 2.0

Description An issue was discovered in LINBIT csync2. It does not correctly check for the return value GNUTLS E WARNING ALERT RECEIVED of the gnutls handshake() function. It neglects to call this function again, as required by the design of the API.

Recommendations For LINBIT csync2 versions through 2.0, ensure that the return value GNUTLS E WARNING ALERT RECEIVED of the gnutls handshake() function is correctly checked and the function is called again as required. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unchecked Return Value

Weakness Enumeration

CWE-252

Related Identifiers

ALT-PU-2023-7630

ALT-PU-2023-7632

ALT-PU-2023-7754

ALT-PU-2024-17519

CVE-2019-15523

DLA-2515-1

OPENSUSE-SU-2021:0853-1

OPENSUSE-SU-2021_0853-1

OPENSUSE-SU-2024:10706-1

SUSE-SU-2021:1858-1

SUSE-SU-2021:1952-1

Affected Products

Alt Linux

Linbit Csync2

Suse

References · 24

• https://github.com/LINBIT/csync2/pull/13/commits/92742544a56bcbcd9ec99ca15f898b31797e39e2 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2021:1858-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15523 · Security Note
• https://ubuntu.com/security/CVE-2019-15523 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-15523 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2021:0853-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-15523 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15523 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10706-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2515-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-15523 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1952-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-15523 · Vendor Advisory
• https://suse.com/support/update/announcement/2021/suse-su-20211858-1 · Note
• https://bugzilla.suse.com/1147137 · Note