CVE-2019-18625 json
An issue was discovered in Suricata 5.0.0.
published 2020-01-06 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-8349
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 77%
- public exploits
- 0
- none known
Summary
An issue was discovered in Suricata 5.0.0. It was possible to bypass/evade any tcp based signature by faking a closed TCP session using an evil server. After the TCP SYN packet, it is possible to inject a RST ACK and a FIN ACK packet with a bad TCP Timestamp option. The client will ignore the RST ACK and the FIN ACK packets because of the bad TCP Timestamp option. Both linux and windows client are ignoring the injected packets.
Patch / fix
- suricata Debian 14, Debian 13 1:5.0.2-1
debian advisories DEBIAN-CVE-2019-18625
Exploit prediction
1.72% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
References
-
github.com
/OISF/suricata/commit/9f0294fadca3dcc18c919424242a41e01f3e8318
patch, third-party-advisory
-
github.com
/OISF/suricata/commit/ea0659de7640cf6a51de5bbd1dbbb0414e4623a0
patch, third-party-advisory
-
redmine.openinfosecfoundation.org
/issues/3286
third-party-advisory
-
redmine.openinfosecfoundation.org
/issues/3395
third-party-advisory
-
lists.debian.org
/debian-lts-announce/2020/01/msg00032.html
mailing-list, third-party-advisory
Sources
- CVE List CVE-2019-18625
- NVD CVE-2019-18625
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.