CVE-2019-18792

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2019-18792
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-18792.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2019-18792
Related
Published
2020-01-06T18:15:23Z
Modified
2025-01-08T10:24:31.764707Z
Downstream
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet. The fake FIN packet is injected just before the PUSH ACK packet we want to bypass. The PUSH ACK packet (containing the data) will be ignored by Suricata because it overlaps the FIN packet (the sequence and ack number are identical in the two packets). The client will ignore the fake FIN packet because the ACK flag is not set. Both linux and windows clients are ignoring the injected packet.

References

Affected packages

Debian:11 / suricata

Package

Name
suricata
Purl
pkg:deb/debian/suricata?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:5.0.2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / suricata

Package

Name
suricata
Purl
pkg:deb/debian/suricata?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:5.0.2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / suricata

Package

Name
suricata
Purl
pkg:deb/debian/suricata?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:5.0.2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/oisf/suricata

Affected ranges

Type
GIT
Repo
https://github.com/oisf/suricata
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1c63d3905852f746ccde7e2585600b2199cefb4b
Fixed
1c63d3905852f746ccde7e2585600b2199cefb4b
Fixed
fa692df37a796c3330c81988d15ef1a219afc006
Fixed
fa692df37a796c3330c81988d15ef1a219afc006

Affected versions

suricata-0.*

suricata-0.8.2

suricata-1.*

suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
suricata-1.2
suricata-1.2.1
suricata-1.2beta1
suricata-1.2rc1
suricata-1.3
suricata-1.3.1
suricata-1.3beta1
suricata-1.3beta2
suricata-1.3rc1
suricata-1.4
suricata-1.4beta1
suricata-1.4beta2
suricata-1.4beta3
suricata-1.4rc1

suricata-2.*

suricata-2.0
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0.2
suricata-2.0beta1
suricata-2.0beta2
suricata-2.0rc1
suricata-2.0rc2
suricata-2.0rc3
suricata-2.1beta1
suricata-2.1beta2
suricata-2.1beta3
suricata-2.1beta4

suricata-3.*

suricata-3.0
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0RC1
suricata-3.0RC2
suricata-3.0RC3
suricata-3.1
suricata-3.1.1
suricata-3.1.2
suricata-3.1RC1
suricata-3.2
suricata-3.2.1
suricata-3.2RC1
suricata-3.2beta1

suricata-4.*

suricata-4.0.0
suricata-4.0.0-beta1
suricata-4.0.0-rc1
suricata-4.0.0-rc2
suricata-4.0.1
suricata-4.1.0
suricata-4.1.0-beta1
suricata-4.1.0-rc1
suricata-4.1.0-rc2
suricata-4.1.1
suricata-4.1.2
suricata-4.1.3
suricata-4.1.4
suricata-4.1.5

suricata-5.*

suricata-5.0.0
suricata-5.0.0-beta1
suricata-5.0.0-rc1