CVE-2019-15523

NameCVE-2019-15523
DescriptionAn issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake() function. It neglects to call this function again, as required by the design of the API.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2515-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
csync2 (PTS)bullseye2.0-25-gc0faaf9-1fixed
sid, trixie, bookworm2.0-42-g83b3644-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
csync2sourcestretch2.0-8-g175a01c-4+deb9u2DLA-2515-1
csync2source(unstable)2.0-25-gc0faaf9-1

Notes

[buster] - csync2 <no-dsa> (Minor issue)
https://github.com/LINBIT/csync2/pull/13/commits/92742544a56bcbcd9ec99ca15f898b31797e39e2

Search for package or bug name: Reporting problems