PT-2024-10750 · Unknown · Asio C++ Library

Published 2024-10-29 · Updated 2024-11-01 · CVE-2019-25219

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Asio C++ Library versions prior to 1.13.0

Description The issue is related to a lack of a fallback error code in the case of SSL ERROR SYSCALL with no associated error information from the SSL library being used. This is a high-severity vulnerability that requires immediate attention. Users are urged to update to the latest version to mitigate risks.

Recommendations For Asio C++ Library versions prior to 1.13.0, update to version 1.13.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of SSL ERROR SYSCALL until a patch is available. Restrict access to the vulnerable library to minimize the risk of exploitation. Avoid using the library in situations where SSL ERROR SYSCALL may occur until the issue is resolved.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

AZL-52023

AZL-52029

CVE-2019-25219

Affected Products

Asio C++ Library

References · 20

• https://osv.dev/vulnerability/DEBIAN-CVE-2019-25219 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25219 · Security Note
• https://osv.dev/vulnerability/CVE-2019-25219 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-25219 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-25219 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-25219 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-52029 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-52023 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-25219 · Vendor Advisory
• https://github.com/chriskohlhoff/asio/commit/93337cba7b013150f5aa6194393e1d94be2853ec · Note
• https://github.com/chriskohlhoff/asio/compare/asio-1-12-2...asio-1-13-0 · Note
• https://twitter.com/transilienceai/status/1852419056684675425 · Twitter Post
• https://twitter.com/transilienceai/status/1852419044361810095 · Twitter Post
• https://twitter.com/transilienceai/status/1852419069775098227 · Twitter Post
• https://t.me/cvedetector/9351 · Telegram Post