CVE-2019-15523

NameCVE-2019-15523
DescriptionAn issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake() function. It neglects to call this function again, as required by the design of the API.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2515-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
csync2 (PTS)stretch2.0-8-g175a01c-4+deb9u1vulnerable
stretch (security)2.0-8-g175a01c-4+deb9u2fixed
buster2.0-22-gce67c55-1+deb10u1vulnerable
bookworm, sid, bullseye2.0-25-gc0faaf9-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
csync2sourcestretch2.0-8-g175a01c-4+deb9u2DLA-2515-1
csync2source(unstable)2.0-25-gc0faaf9-1

Notes

[buster] - csync2 <no-dsa> (Minor issue)
https://github.com/LINBIT/csync2/pull/13/commits/92742544a56bcbcd9ec99ca15f898b31797e39e2

Search for package or bug name: Reporting problems