CVE-2019-10054

Published: Aug 28, 2019Modified: Jun 17, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in Suricata 4.1.3. The function process_reply_record_v3 lacks a check for the length of reply.data. It causes an invalid memory access and the program crashes within the nfs/nfs3.rs file.

Affected (1)

Products: Suricata Ids: Suricata

Suricata Ids

1 product

Suricata

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Suricata Ids Suricata	Version 4.1.3

Related CWEs

CWE-191

Integer Underflow (Wrap or Wraparound)

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

https://redmine.openinfosecfoundation.org/issues/2943

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/

Source: cve@mitre.org

Release NotesVendor Advisory

https://redmine.openinfosecfoundation.org/issues/2943

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingThird Party Advisory

https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.