CVE-2019-5152

Name	CVE-2019-5152
Description	An exploitable information disclosure vulnerability exists in the network packet handling functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher, a specially crafted set of network packets can cause an outbound connection from the server, resulting in information disclosure. An attacker can send arbitrary packets to trigger this vulnerability.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
shadowsocks-libev (PTS)	buster	3.2.5+ds-1	vulnerable
	bullseye	3.3.5+ds-4	vulnerable
	sid, bookworm	3.3.5+ds-10	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
shadowsocks-libev	source	(unstable)	(unfixed)	unimportant

Notes

https://talosintelligence.com/vulnerability_reports/TALOS-2019-0942
https://github.com/shadowsocks/shadowsocks-libev/issues/2525
Upstream has no plan to remove stream ciphers as per
https://github.com/shadowsocks/shadowsocks-libev/issues/2525#issuecomment-557551274
Documented insecure use case provided for backwards compatibility.