2019-04-23 19:00:50 +00:00
{
2020-01-15 20:01:19 +00:00
"CVE_data_meta" : {
"AKA" : "SACK Panic" ,
"ASSIGNER" : "security@ubuntu.com" ,
"DATE_PUBLIC" : "2019-06-17T00:00:00.000Z" ,
"ID" : "CVE-2019-11477" ,
"STATE" : "PUBLIC" ,
"TITLE" : "Integer overflow in TCP_SKB_CB(skb)->tcp_gso_segs"
2019-04-23 19:00:50 +00:00
} ,
2020-01-15 20:01:19 +00:00
"affects" : {
"vendor" : {
"vendor_data" : [
2019-06-17 16:21:26 -07:00
{
2020-01-15 20:01:19 +00:00
"product" : {
"product_data" : [
2019-06-17 16:21:26 -07:00
{
2020-01-15 20:01:19 +00:00
"product_name" : "Linux kernel" ,
"version" : {
"version_data" : [
2019-06-17 16:21:26 -07:00
{
2020-01-15 20:01:19 +00:00
"version_affected" : "<" ,
"version_name" : "4.4" ,
"version_value" : "4.4.182"
2019-06-17 16:21:26 -07:00
} ,
{
2020-01-15 20:01:19 +00:00
"version_affected" : "<" ,
"version_name" : "4.9" ,
"version_value" : "4.9.182"
2019-06-17 16:21:26 -07:00
} ,
{
2020-01-15 20:01:19 +00:00
"version_affected" : "<" ,
"version_name" : "4.14" ,
"version_value" : "4.14.127"
2019-06-17 16:21:26 -07:00
} ,
{
2020-01-15 20:01:19 +00:00
"version_affected" : "<" ,
"version_name" : "4.19" ,
"version_value" : "4.19.52"
2019-06-17 16:21:26 -07:00
} ,
{
2020-01-15 20:01:19 +00:00
"version_affected" : "<" ,
"version_name" : "5.1" ,
"version_value" : "5.1.11"
2019-06-17 16:21:26 -07:00
}
]
}
}
]
} ,
2020-01-15 20:01:19 +00:00
"vendor_name" : "Linux"
2019-06-17 16:21:26 -07:00
}
]
}
} ,
2020-01-15 20:01:19 +00:00
"credit" : [
2019-06-17 16:21:26 -07:00
{
2020-01-15 20:01:19 +00:00
"lang" : "eng" ,
"value" : "Jonathan Looney from Netflix"
2019-06-17 16:21:26 -07:00
}
] ,
2020-01-15 20:01:19 +00:00
"data_format" : "MITRE" ,
"data_type" : "CVE" ,
"data_version" : "4.0" ,
"description" : {
"description_data" : [
{
"lang" : "eng" ,
"value" : "Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff."
2019-04-23 19:00:50 +00:00
}
]
2019-06-17 16:21:26 -07:00
} ,
2020-01-15 20:01:19 +00:00
"generator" : {
"engine" : "Vulnogram 0.0.7"
2019-06-17 16:21:26 -07:00
} ,
2020-01-15 20:01:19 +00:00
"impact" : {
"cvss" : {
"attackComplexity" : "LOW" ,
"attackVector" : "NETWORK" ,
"availabilityImpact" : "HIGH" ,
"baseScore" : 7.5 ,
"baseSeverity" : "HIGH" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "NONE" ,
"privilegesRequired" : "NONE" ,
"scope" : "UNCHANGED" ,
"userInteraction" : "NONE" ,
"vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" ,
"version" : "3.0"
2019-06-17 16:21:26 -07:00
}
} ,
2020-01-15 20:01:19 +00:00
"problemtype" : {
"problemtype_data" : [
2019-06-17 16:21:26 -07:00
{
2020-01-15 20:01:19 +00:00
"description" : [
2019-06-17 16:21:26 -07:00
{
2020-01-15 20:01:19 +00:00
"lang" : "eng" ,
"value" : "CWE-190 Integer Overflow or Wraparound"
2019-06-17 16:21:26 -07:00
}
]
}
]
} ,
2020-01-15 20:01:19 +00:00
"references" : {
"reference_data" : [
2019-06-17 16:21:26 -07:00
{
2020-01-15 20:01:19 +00:00
"refsource" : "MISC" ,
"url" : "https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=3b4929f65b0d8249f19a50245cd88ed1a2f78cff" ,
"name" : "https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=3b4929f65b0d8249f19a50245cd88ed1a2f78cff"
2019-06-17 16:21:26 -07:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "MISC" ,
"url" : "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md" ,
"name" : "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md"
2019-06-17 16:21:26 -07:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "MISC" ,
"url" : "https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic" ,
"name" : "https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic"
2019-06-17 16:21:26 -07:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "MISC" ,
"url" : "https://access.redhat.com/security/vulnerabilities/tcpsack" ,
"name" : "https://access.redhat.com/security/vulnerabilities/tcpsack"
2019-06-19 07:00:46 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "CONFIRM" ,
"name" : "https://support.f5.com/csp/article/K78234183" ,
"url" : "https://support.f5.com/csp/article/K78234183"
2019-06-19 19:00:46 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "MISC" ,
"name" : "http://packetstormsecurity.com/files/153346/Kernel-Live-Patch-Security-Notice-LSN-0052-1.html" ,
"url" : "http://packetstormsecurity.com/files/153346/Kernel-Live-Patch-Security-Notice-LSN-0052-1.html"
2019-06-19 20:00:46 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "CONFIRM" ,
"name" : "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193" ,
"url" : "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193"
2019-06-20 20:00:46 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "CERT-VN" ,
"name" : "VU#905115" ,
"url" : "https://www.kb.cert.org/vuls/id/905115"
2019-06-20 21:00:53 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "MLIST" ,
"name" : "[oss-security] 20190620 Re: Linux and FreeBSD Kernel: Multiple TCP-based remote denial of service issues" ,
"url" : "http://www.openwall.com/lists/oss-security/2019/06/20/3"
2019-06-25 07:00:47 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "CONFIRM" ,
"name" : "https://www.synology.com/security/advisory/Synology_SA_19_28" ,
"url" : "https://www.synology.com/security/advisory/Synology_SA_19_28"
2019-06-25 10:00:46 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "CONFIRM" ,
"name" : "https://security.netapp.com/advisory/ntap-20190625-0001/" ,
"url" : "https://security.netapp.com/advisory/ntap-20190625-0001/"
2019-06-25 13:00:48 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:1594" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:1594"
2019-06-25 21:00:48 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:1602" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:1602"
2019-06-27 00:00:51 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "CONFIRM" ,
"name" : "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0006" ,
"url" : "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0006"
2019-06-28 08:00:46 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "CONFIRM" ,
"name" : "https://kc.mcafee.com/corporate/index?page=content&id=SB10287" ,
"url" : "https://kc.mcafee.com/corporate/index?page=content&id=SB10287"
2019-06-28 21:00:58 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "MLIST" ,
"name" : "[oss-security] 20190628 Re: linux-distros membership application - Microsoft" ,
"url" : "http://www.openwall.com/lists/oss-security/2019/06/28/2"
2019-07-02 17:00:54 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "CONFIRM" ,
"name" : "http://www.vmware.com/security/advisories/VMSA-2019-0010.html" ,
"url" : "http://www.vmware.com/security/advisories/VMSA-2019-0010.html"
2019-07-07 00:01:00 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "MLIST" ,
"name" : "[oss-security] 20190706 Re: linux-distros membership application - Microsoft" ,
"url" : "http://www.openwall.com/lists/oss-security/2019/07/06/3"
2019-07-07 00:01:00 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "MLIST" ,
"name" : "[oss-security] 20190706 Re: linux-distros membership application - Microsoft" ,
"url" : "http://www.openwall.com/lists/oss-security/2019/07/06/4"
2019-07-08 12:01:06 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:1699" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:1699"
2019-09-10 13:00:52 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "CONFIRM" ,
"name" : "https://cert-portal.siemens.com/productcert/pdf/ssa-462066.pdf" ,
"url" : "https://cert-portal.siemens.com/productcert/pdf/ssa-462066.pdf"
2019-09-24 16:01:00 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "MISC" ,
"name" : "https://www.us-cert.gov/ics/advisories/icsa-19-253-03" ,
"url" : "https://www.us-cert.gov/ics/advisories/icsa-19-253-03"
2019-10-23 20:01:04 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "MISC" ,
"name" : "http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html" ,
"url" : "http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html"
2019-10-24 12:01:28 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "MLIST" ,
"name" : "[oss-security] 20191023 Membership application for linux-distros - VMware" ,
"url" : "http://www.openwall.com/lists/oss-security/2019/10/24/1"
2019-10-30 00:01:13 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "MLIST" ,
"name" : "[oss-security] 20191029 Re: Membership application for linux-distros - VMware" ,
"url" : "http://www.openwall.com/lists/oss-security/2019/10/29/3"
2019-12-26 02:01:00 +00:00
} ,
{
2020-01-15 20:01:19 +00:00
"refsource" : "CONFIRM" ,
"name" : "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191225-01-kernel-en" ,
"url" : "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191225-01-kernel-en"
2020-01-14 15:46:23 -08:00
} ,
{
2020-01-15 20:01:19 +00:00
"url" : "https://www.oracle.com/security-alerts/cpujan2020.html" ,
"refsource" : "MISC" ,
"name" : "https://www.oracle.com/security-alerts/cpujan2020.html"
2019-06-17 16:21:26 -07:00
}
]
} ,
2020-01-15 20:01:19 +00:00
"source" : {
"advisory" : "https://usn.ubuntu.com/4017-1" ,
"defect" : [
2019-06-17 16:21:26 -07:00
"https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1831637"
] ,
2020-01-15 20:01:19 +00:00
"discovery" : "UNKNOWN"
2019-04-23 19:00:50 +00:00
}
2019-06-19 00:00:51 +00:00
}
