CVE-2019-15699: Critical severity suricata vulnerability
Published Sep 24, 2019
·Updated
An issue was discovered in app-layer-ssl.c in Suricata 4.1.4. Upon receiving a corrupted SSLv3 (TLS 1.2) packet, the parser function TLSDecodeHSHelloExtensions tries to access a memory region that is not allocated, because the expected length of HSHelloExtensions does not match the real length of the HSHelloExtensions part of the packet.
Affected Software
1 affected component
Suricata-ids Suricata=4.1.4
Event History
Sep 24, 2019
CVE Published
via MITRE·07:20 PM
Data Sourced
via MITRE·07:20 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2019-15699.
2
What is the severity of CVE-2019-15699?
CVE-2019-15699 has a severity rating of 9.1 (Critical).
3
What is the affected software of CVE-2019-15699?
The affected software is Suricata 4.1.4.
4
How can I fix CVE-2019-15699?
To fix CVE-2019-15699, you should update Suricata to version 4.1.5 or later.
5
What is the Common Weakness Enumeration (CWE) ID of CVE-2019-15699?
The CWE ID of CVE-2019-15699 is CWE-125.