CVE-2019-16239 — Classic Buffer Overflow in Openconnect

CWE-120 — Classic Buffer Overflow6 documents6 sources
Severity
9.8CRITICALNVD
EPSS
8.5%
top 7.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Infradead OpenconnectCanonical Ubuntu LinuxDebian Linux+2 more
Timeline
PublishedSep 17
Latest updateMay 24

Description

process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶Debianinfradead/openconnect< 8.02-1.1+3
▶NVDopensuse/leap15.0, 15.1+1

Also affects: Debian Linux 10.0, 8.0, 9.0, Fedora 29, 30, 31, Ubuntu Linux 18.04

🔴Vulnerability Details

3
GHSA
GHSA-j5c8-5345-567f: process_http_response in OpenConnect before 8↗2022-05-24
▶
OSV
CVE-2019-16239: process_http_response in OpenConnect before 8↗2019-09-17
▶
CVEList
CVE-2019-16239: process_http_response in OpenConnect before 8↗2019-09-17
▶

📋Vendor Advisories

2
Ubuntu
OpenConnect vulnerability↗2020-10-05
▶
Debian
CVE-2019-16239: openconnect - process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a ma...↗2019
▶
CVE-2019-16239 — Classic Buffer Overflow in Openconnect | cvebase