CVE-2019-5163
First published: Tue Dec 03 2019(Updated: )
An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher and a local_address, arbitrary UDP packets can cause a FATAL error code path and exit. An attacker can send arbitrary UDP packets to trigger this vulnerability.
Credit: talos-cna@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Shadowsocks Shadowsocks-libev | =3.3.2 | |
| Opensuse Backports | =sle-15-sp1 | |
| openSUSE Leap | =15.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2019-5163.
What is the severity of CVE-2019-5163?
The severity of CVE-2019-5163 is high.
What is the affected software for CVE-2019-5163?
The affected software for CVE-2019-5163 is Shadowsocks-libev 3.3.2, Opensuse Backports sle-15-sp1, and openSUSE Leap 15.1.
How does the vulnerability work?
The vulnerability allows an attacker to send arbitrary UDP packets to trigger a denial-of-service condition.
Are there any references for CVE-2019-5163?
Yes, you can find more information about CVE-2019-5163 at the following references: [link1](http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00023.html), [link2](http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00061.html), [link3](https://talosintelligence.com/vulnerability_reports/TALOS-2019-0956).
- collector/nvd-index
- agent/author
- agent/weakness
- agent/severity
- agent/references
- agent/description
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- vendor/shadowsocks
- canonical/shadowsocks shadowsocks-libev
- version/shadowsocks shadowsocks-libev/3.3.2
- vendor/opensuse
- canonical/opensuse backports
- version/opensuse backports/sle-15-sp1
- canonical/opensuse leap
- version/opensuse leap/15.1