CVE-2019-5163
Fixed in a distro release EPSS 3%CVSS 5.9
An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher and a local_address, arbitrary UDP packets can cause a FATAL error code path and exit. An attacker can send arbitrary UDP packets to trigger this vulnerability.
Products: shadowsocks-libev, opensuse backports, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | shadowsocks-libev | 3.3.3+ds-2 |
| Debian 13 | shadowsocks-libev | 3.3.3+ds-2 |
| SUSE Package Hub 15 SP1 | shadowsocks-libev | 3.3.3-bp151.5.3.1 |
| Ubuntu 18.04 LTS | shadowsocks-libev | no fix |
| openSUSE Leap 15.1 | shadowsocks-libev | 3.3.3-lp151.2.3.1 |
| openSUSE Tumbleweed | shadowsocks-libev | 3.3.5-1.9 |