CVE-2019-15699
First published: Tue Sep 24 2019(Updated: )
An issue was discovered in app-layer-ssl.c in Suricata 4.1.4. Upon receiving a corrupted SSLv3 (TLS 1.2) packet, the parser function TLSDecodeHSHelloExtensions tries to access a memory region that is not allocated, because the expected length of HSHelloExtensions does not match the real length of the HSHelloExtensions part of the packet.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Suricata-ids Suricata | =4.1.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2019-15699.
What is the severity of CVE-2019-15699?
CVE-2019-15699 has a severity rating of 9.1 (Critical).
What is the affected software of CVE-2019-15699?
The affected software is Suricata 4.1.4.
How can I fix CVE-2019-15699?
To fix CVE-2019-15699, you should update Suricata to version 4.1.5 or later.
What is the Common Weakness Enumeration (CWE) ID of CVE-2019-15699?
The CWE ID of CVE-2019-15699 is CWE-125.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/description
- agent/type
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/suricata-ids
- canonical/suricata-ids suricata
- version/suricata-ids suricata/4.1.4