CVE-2019-5163CWE-306

An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2

Medium · published December 3, 2019

CVSS v3.0
5.9
EPSS
3%
Percentile
85.5
In the wild
Unconfirmed
What it is

An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher and a local_address, arbitrary UDP packets can cause a FATAL error code path and exit. An attacker can send arbitrary UDP packets to trigger this vulnerability.

The record
Technical detail
CVSS v3.0
5.9 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02642 · 85.5th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2019-12-03T21:55Z
EPSS history
Timeline
  • 03 DEC 21:55Z
    An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2
    cvelistv5