CVE-2019-10050

{"id": "CVE-2019-10050", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-05-13T17:29:02.097", "references": [{"url": "https://lists.openinfosecfoundation.org/pipermail/oisf-announce/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the decode-mpls.c function DecodeMPLS is composed only of a packet of source address and destination address plus the correct type field and the right number for shim, an attacker can manipulate the control flow, such that the condition to leave the loop is true. After leaving the loop, the network packet has a length of 2 bytes. There is no validation of this length. Later on, the code tries to read at an empty position, leading to a crash."}, {"lang": "es", "value": "Se descubri\u00f3 un problema de sobrelectura de b\u00fafer en Suricata, versiones 4.1.x anteriores a 4.1.4. Si la entrada de la funci\u00f3n decode-mpls.c DecodeMPLS est\u00e1 compuesta s\u00f3lo por un paquete de direcci\u00f3n de origen y direcci\u00f3n de destino m\u00e1s el campo de tipo correcto y el n\u00famero correcto de shim, un atacante puede manipular el flujo de control, de tal forma que la condici\u00f3n para abandonar el bucle sea verdadera. Despu\u00e9s de salir del bucle, el paquete de red tiene una longitud de 2 bytes. No hay validaci\u00f3n de esta longitud. M\u00e1s tarde, el c\u00f3digo intenta leer en una posici\u00f3n vac\u00eda, provocando un fallo."}], "lastModified": "2019-10-24T16:19:30.683", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F301FC21-7AD7-46B5-B85C-FCB0C5B3DBF5", "versionEndExcluding": "4.1.4", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}