CVE-2019-5152

An exploitable information disclosure vulnerability exists in the network packet handling functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher, a specially crafted set of network packets can cause an outbound connection from the server, resulting in information disclosure. An attacker can send arbitrary packets to trigger this vulnerability.

CVSS v3.1

7.4 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v3.0

7.4 HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v2.0

5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N

EPSS

1.38% chance of exploitation in the next 30 days, 70th percentile

Published

2019-12-18

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0942

References

• CVE Record
• NVD entry

Related

• CVE-2019-5151
• CVE-2019-5153
• CVE-2019-5150
• CVE-2019-5155
• CVE-2019-5149
• CVE-2019-5156