CVE-2019-16239
published 2019-09-17CVE-2019-16239: process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.
PriorityP350critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.45%
87.8th percentile
process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | openconnect | < openconnect 8.02-1.1 (bookworm) | openconnect 8.02-1.1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| infradead | openconnect | < 8.05 | 8.05 |
| infradead | openconnect | >= 0 < 8.02-1.1 | 8.02-1.1 |
| infradead | openconnect | >= 0 < 8.02-1.1 | 8.02-1.1 |
| infradead | openconnect | >= 0 < 8.02-1.1 | 8.02-1.1 |
| infradead | openconnect | >= 0 < 8.02-1.1 | 8.02-1.1 |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j5c8-5345-567f: process_http_response in OpenConnect before 8
ghsa_unreviewed·2022-05-24
CVE-2019-16239 [HIGH] CWE-120 GHSA-j5c8-5345-567f: process_http_response in OpenConnect before 8
process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.
OSV
CVE-2019-16239: process_http_response in OpenConnect before 8
osv·2019-09-17·CVSS 9.8
CVE-2019-16239 [CRITICAL] CVE-2019-16239: process_http_response in OpenConnect before 8
process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.
Ubuntu
OpenConnect vulnerability
vendor_ubuntu·2020-10-05
CVE-2019-16239 OpenConnect vulnerability
Title: OpenConnect vulnerability
Summary: OpenConnect could be made to crash if it received specially crafted
input.
It was discovered that OpenConnect has a buffer overflow when a malicious
server uses HTTP chunked encoding with crafted chunk sizes. An attacker
could use it to provoke a denial of service (crash).
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2019-16239: openconnect - process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a ma...
vendor_debian·2019·CVSS 9.8
CVE-2019-16239 [CRITICAL] CVE-2019-16239: openconnect - process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a ma...
process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.
Scope: local
bookworm: resolved (fixed in 8.02-1.1)
bullseye: resolved (fixed in 8.02-1.1)
forky: resolved (fixed in 8.02-1.1)
sid: resolved (fixed in 8.02-1.1)
trixie: resolved (fixed in 8.02-1.1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.infradead.org/pipermail/openconnect-devel/2019-September/005412.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00060.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00061.htmlhttps://lists.debian.org/debian-lts-announce/2019/10/msg00003.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FX56KYWC7X4ETV4P6HGJC7GZUEBITBBS/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDMZGNBLZZKAGBI2PNXYWWKLD2LXKFH6/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WI7ZENFAWCHF2RU4NHPL2CU4WGZ4BNDJ/https://seclists.org/bugtraq/2020/Jan/31https://t2.fi/schedule/2019/https://usn.ubuntu.com/4565-1/https://www.debian.org/security/2020/dsa-4607http://lists.infradead.org/pipermail/openconnect-devel/2019-September/005412.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00060.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00061.htmlhttps://lists.debian.org/debian-lts-announce/2019/10/msg00003.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FX56KYWC7X4ETV4P6HGJC7GZUEBITBBS/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDMZGNBLZZKAGBI2PNXYWWKLD2LXKFH6/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WI7ZENFAWCHF2RU4NHPL2CU4WGZ4BNDJ/https://seclists.org/bugtraq/2020/Jan/31https://t2.fi/schedule/2019/https://usn.ubuntu.com/4565-1/https://www.debian.org/security/2020/dsa-4607
2019-09-17
Published