CVE-2019-11578

auth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks.

5.9 MediumFix available

auth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

2.04%Up 0.8 points since Apr 14, 2021

What each source reports

NVD Score used 5.9

auth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks.

Record: CVE-2019-11578
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness: CWE-203
Updated: 2026-11-02

CVE List No score

auth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks.

Record: CVE-2019-11578
Updated: 2026-11-02

EUVDEUVD-2019-3248 No score

auth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks.

Record: EUVD-2019-3248
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wmp8-c7xc-v29x No score

auth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks.

auth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks.

Record: GHSA-wmp8-c7xc-v29x
Updated: 2026-11-02

OSV 5.9

auth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks.

Record: CVE-2019-11578
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-11578 5.9

auth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks.

Record: DEBIAN-CVE-2019-11578
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-11578 5.9

auth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks.

Record: UBUNTU-CVE-2019-11578
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Affected products

dhcpcd project dhcpcd

Affected packages

Affected packages
Package	Affected	Fixed
`dhcpcd5` Debian:12	before 7.1.0-2	7.1.0-2
`dhcpcd5` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 5.5.6-16.0.5-1ubuntu16.0.5-1.16.0.5-2build0.14.04.16.0.5-2+deb8u1build0.14.04.1~esm1	None known
`dhcpcd5` Ubuntu:16.04:LTS	All versions, plus listed versions 6.9.1-16.9.3-16.10.1-1	None known
`dhcpcd5` Ubuntu:18.04:LTS	All versions, plus listed versions 6.11.5-0ubuntu1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-11578 is a medium vulnerability (CVSS 5.9) in Dhcpcd Project Dhcpcd, published April 28, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.04%, the 81st percentile. Fixed in dhcpcd5 7.1.0-2.

References

Show 4 moreShow less