An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a failure of a hello command when the configuration requires use of SSL.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a     failure of a hello command when the configuration requires use of SSL. (CVE-2019-15522)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:1952-1 advisory.

  - An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a     failure of a hello command when the configuration requires use of SSL. (CVE-2019-15522)

  - An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value     GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake() function. It neglects to call this function     again, as required by the design of the API. (CVE-2019-15523)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:1858-1 advisory.

  - An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a     failure of a hello command when the configuration requires use of SSL. (CVE-2019-15522)

  - An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value     GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake() function. It neglects to call this function     again, as required by the design of the API. (CVE-2019-15523)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for csync2 fixes the following issues :

  - CVE-2019-15522: Fixed an issue where daemon fails to     enforce TLS (bsc#1147137)

  - CVE-2019-15523: Fixed an incorrect TLS handshake error     handling (bsc#1147139)

This update was imported from the SUSE:SLE-15:Update update project.

ID	Name	Product	Family	Severity
253967	Linux Distros Unpatched Vulnerability : CVE-2019-15522	Nessus	Misc.	critical
150742	SUSE SLES12 Security Update : csync2 (SUSE-SU-2021:1952-1)	Nessus	SuSE Local Security Checks	critical
150695	SUSE SLES15 Security Update : csync2 (SUSE-SU-2021:1858-1)	Nessus	SuSE Local Security Checks	critical
150474	openSUSE Security Update : csync2 (openSUSE-2021-853)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2019-15522

critical

Tenable Plugins

critical

critical

critical

critical