CVE-2019-18792 — Interpretation Conflict in Suricata

CWE-436 — Interpretation ConflictCWE-94 — Code Injection5 documents5 sources
Severity
9.1CRITICALNVD
EPSS
0.2%
top 59.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Oisf SuricataDebian Linux
Timeline
PublishedJan 6
Latest updateMay 24

Description

An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet. The fake FIN packet is injected just before the PUSH ACK packet we want to bypass. The PUSH ACK packet (containing the data) will be ignored by Suricata because it overlaps the FIN packet (the sequence and ack number are identical in the two packets). The client will ignore the fake FIN packet because the ACK flag is not set. Both linux and window…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages2 packages

▶NVDoisf/suricata4.1.5 — 4.1.6+1
▶Debianoisf/suricata< 1:5.0.2-1+3

Also affects: Debian Linux 8.0

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-p4hg-mvq8-47jj: An issue was discovered in Suricata 5↗2022-05-24
▶
CVEList
CVE-2019-18792: An issue was discovered in Suricata 5↗2020-01-06
▶
OSV
CVE-2019-18792: An issue was discovered in Suricata 5↗2020-01-06
▶

📋Vendor Advisories

1
Debian
CVE-2019-18792: suricata - An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tc...↗2019
▶
CVE-2019-18792 — Interpretation Conflict in Suricata | cvebase