CVE-2019-18792: debian debian_linux Interpretation Conflict
Vulnerability summary
CVE-2019-18792 is a critical (CVSS 9.1) Interpretation Conflict vulnerability in debian debian_linux. EPSS estimates a 2.52% chance of exploitation in the next 30 days, higher than 84.7% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 06-01-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet. The fake FIN packet is injected just before the PUSH ACK packet we want to bypass. The PUSH ACK packet (containing the data) will be ignored by Suricata because it overlaps the FIN packet (the sequence and ack number are identical in the two packets). The client will ignore the fake FIN packet because the ACK flag is not set. Both linux and windows clients are ignoring the injected packet.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS trend
Probability
2.52%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.52% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (redmine.openinfosecfoundation.org)
Maturity: unknown
Exploit Reference (redmine.openinfosecfoundation.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- suricata< 1:5.0.2-1
- debian_linuxEOL8.0
Oisf1 product
- suricata≥ 4.1.5, < 4.1.6 | 5.0.0
Ubuntu1 product
- suricataAll versions (No fix recorded)
3 vendors · 4 products
References
8 links- github.com/OISF/suricata/commit/fa692df37a796c3330c81988d15ef1a219afc006X Refsource CONFIRMREPORTPatchThird Party Advisory
- github.com/OISF/suricata/commit/1c63d3905852f746ccde7e2585600b2199cefb4bX Refsource CONFIRMREPORTPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2020/01/msg00032.htmlMailing ListX Refsource MLISTThird Party Advisory