CVE-2019-5164

Upstream information

CVE-2019-5164 at MITRE

Description

An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets sent to ss-manager can cause an arbitrary binary to run, resulting in code execution and privilege escalation. An attacker can send network packets to trigger this vulnerability.

---

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having low severity.

SUSE Bugzilla entry: 1158365 [RESOLVED / FIXED]

SUSE Security Advisories:

• openSUSE-SU-2019:2667-1, published Wed, 11 Dec 2019 15:13:33 +0100 (CET)
• openSUSE-SU-2020:0142-1, published Wed, 29 Jan 2020 21:36:03 +0100 (CET)

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Package Hub for SUSE Linux Enterprise 15 SP1	libshadowsocks-libev2 >= 3.3.3-bp151.5.3.1 shadowsocks-libev >= 3.3.3-bp151.5.3.1 shadowsocks-libev-devel >= 3.3.3-bp151.5.3.1 shadowsocks-libev-doc >= 3.3.3-bp151.5.3.1	Patchnames: openSUSE-2020-142
openSUSE Leap 15.1	libshadowsocks-libev2 >= 3.3.3-lp151.2.3.1 shadowsocks-libev >= 3.3.3-lp151.2.3.1 shadowsocks-libev-devel >= 3.3.3-lp151.2.3.1 shadowsocks-libev-doc >= 3.3.3-lp151.2.3.1	Patchnames: openSUSE-2019-2667
openSUSE Tumbleweed	libshadowsocks-libev2 >= 3.3.5-1.9 shadowsocks-libev >= 3.3.5-1.9 shadowsocks-libev-devel >= 3.3.5-1.9 shadowsocks-libev-doc >= 3.3.5-1.9	Patchnames: openSUSE Tumbleweed GA libshadowsocks-libev2-3.3.5-1.9