Unscored CVE-2019-17420 EUVD-2019-7816GHSA-9gx8-hhv8-hw56

In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the http_header signature…

Published Oct 9, 2019 · Updated Aug 5, 2024 · Assigned by mitre

Package: libhtp Package: libhtp Ecosystem: Debian Ecosystem: Ubuntu

Description

In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the http_header signature to not alert on a response with a single \r\n ending.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 13	libhtp	1:0.5.31-1	—
Debian 12	libhtp	1:0.5.31-1	—

Ubuntu