Name: CVE-2019-16239: Buffer Copy without Checking Size of Input
Creator: Rapid7
Published: 2019-09-17T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2019-16239, CWE-120, CVSS 9.8, EPSS 0.08525

process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.

CVSS Details

CVSS 3.1 Base Score: 9.8
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Debian	—	Upgrade openconnect	Oct 4, 2019	Sep 17, 2019
Suse	—	Upgrade openconnect-develUpgrade openconnectUpgrade openconnect-docUpgrade openconnect-lang	Oct 23, 2019	Sep 17, 2019
Ubuntu	—	Upgrade libopenconnect5Upgrade openconnect	Oct 6, 2020	Sep 17, 2019

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business