CVE-2019-10054: suricata-ids suricata Improper Input Validation
CVSS: 7.5v3.0HighModified
AliasesUBUNTU-CVE-2019-10054DEBIAN-CVE-2019-10054
Published 28-08-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-10054 is a high (CVSS 7.5) Improper Input Validation vulnerability in suricata-ids suricata. EPSS estimates a 1.40% chance of exploitation in the next 30 days, higher than 72.2% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.0 (NVD)EPSS score
1.40%
0%100%
Low · +0.05 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 28-08-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Suricata 4.1.3. The function process_reply_record_v3 lacks a check for the length of reply.data. It causes an invalid memory access and the program crashes within the nfs/nfs3.rs file.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
1.40%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
+0.05 pp
From 1.34% on 21-09-2026
21-09-202621-10-2026
EPSS score1.40%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (redmine.openinfosecfoundation.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Affected systems
Debian1 product
- suricata< 1:4.1.4-1
Suricata-ids1 product
- suricata4.1.3
Ubuntu1 product
- suricataAll versions (No fix recorded)
3 vendors · 3 products
References
5 links- suricata-ids.org/2019/04/30/suricata-4-1-4-released/X Refsource CONFIRMRelease NotesVendor AdvisoryREPORT
- redmine.openinfosecfoundation.org/issues/2943X Refsource MISCExploitIssue TrackingThird Party AdvisoryREPORT
