Back
CVE-2019-18625
An issue was discovered in Suricata 5.0.0. It was possible to bypass/evade any tcp based signature by faking a closed TCP session using an…
High7.5EPSS 1.7%
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
An issue was discovered in Suricata 5.0.0. It was possible to bypass/evade any tcp based signature by faking a closed TCP session using an evil server. After the TCP SYN packet, it is possible to inject a RST ACK and a FIN ACK packet with a bad TCP Timestamp option. The client will ignore the RST ACK and the FIN ACK packets because of the bad TCP Timestamp option. Both linux and windows client are ignoring the injected packets.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
- EPSS (exploitation in 30 days)
- 1.7% · top 22% of all CVEs (6 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
- n/a
Affected products
n/a
- affected n/a
References (5)
- https://redmine.openinfosecfoundation.org/issues/3286 (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/OISF/suricata/commit/9f0294fadca3dcc18c919424242a41e01f3e8318 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://redmine.openinfosecfoundation.org/issues/3395 (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/OISF/suricata/commit/ea0659de7640cf6a51de5bbd1dbbb0414e4623a0 (opens in a new tab)x_refsource_CONFIRMx_transferred
- [debian-lts-announce] 20200130 [SECURITY] [DLA 2087-1] suricata security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-18625)Record last updated .