CVE-2019-14511

NameCVE-2019-14511
DescriptionSphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
Debian Bugs939762

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
sphinxsearch (PTS)stretch2.2.11-1.1vulnerable
stretch (security)2.2.11-1.1+deb9u1vulnerable
buster, buster (security)2.2.11-2+deb10u1vulnerable
bookworm, sid2.2.11-8fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
sphinxsearchsource(unstable)2.2.11-4unimportant939762

Notes

Issue is just with the default configuration, but can be easily reconfigured
to listen on localhost only. sphinxsearch will not be started automatically
and an admin needs first to create anyway a /etc/sphinxsearch/sphinx.conf
starting from a sample.
sphinxsearch should ideally update the defaults in sample configs to bind
listeners to localhost.
This is not treated as a vulnerability, subject to design choices for deployment

Search for package or bug name: Reporting problems