TCP Signature Bypass in Suricata by Open Information Security Foundation
CVE-2019-18792

9.1CRITICAL

Key Information:

Vendor: Suricata-ids
Status: Suricata
Vendor: CVE Published:; 6 January 2020

🔔 Create Suricata-ids Vulnerability Alert

What is CVE-2019-18792?

An issue in Suricata 5.0.0 allows attackers to bypass TCP-based signatures by injecting a fake FIN packet before a PUSH ACK packet. The overlapping sequence and acknowledgment numbers cause Suricata to ignore the PUSH ACK packet, compromising network security. This vulnerability impacts both Linux and Windows clients that do not detect the injected packet due to the non-set ACK flag, presenting significant concerns for users relying on Suricata for network monitoring.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch