{"id":"CVE-2019-15523","aliases":["ALPINE-CVE-2019-15523","DEBIAN-CVE-2019-15523","DLA-2515-1","EUVD-2019-6508","GHSA-hw3p-w63h-mj9c","SUSE-SU-2021:1858-1","SUSE-SU-2021:1952-1","UBUNTU-CVE-2019-15523","openSUSE-SU-2021:0853-1","openSUSE-SU-2024:10706-1"],"status":"published","title":"An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return...","description":"An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake() function. It neglects to call this function again, as required by the design of the API.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01418,"percentile":0.72992,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-252"],"published":"2020-12-30T20:04:16Z","modified":"2026-11-03T06:31:51Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"csync2","fixed_in":["2.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"csync2","fixed_in":["2.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"csync2","fixed_in":["2.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"csync2","fixed_in":["2.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"csync2","fixed_in":["2.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"csync2","fixed_in":["2.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"csync2","fixed_in":["2.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"csync2","fixed_in":["2.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"csync2","fixed_in":["2.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"csync2","fixed_in":["2.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"csync2","fixed_in":["2.0-r3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"csync2","fixed_in":["2.0-25-gc0faaf9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"csync2","fixed_in":["2.0-25-gc0faaf9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"csync2","fixed_in":["2.0-25-gc0faaf9-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"csync2","fixed_in":["2.0-8-g175a01c-4+deb9u2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-r3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-25-gc0faaf9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-25-gc0faaf9-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-25-gc0faaf9-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-8-g175a01c-4+deb9u2"}]}],"versions":["2.0-8-g175a01c-4","2.0-8-g175a01c-4+deb9u1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0+git.1461714863.10636a4-4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0+git.1461714863.10636a4-4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0+git.1461714863.10636a4-4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP3","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0+git.1368794815.cf835a7-3.9.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP4","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0+git.1368794815.cf835a7-3.9.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0+git.1368794815.cf835a7-3.9.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0+73d3293-2","2.0+73d3293-2build1","2.0+73d3293-2build2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0-8-g175a01c-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0-8-g175a01c-4ubuntu2","2.0-22-gce67c55-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0+git.1461714863.10636a4-lp152.5.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"csync2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0+git.1600444747.83b3644-1.3"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"linbit","product":"csync2"}],"references":[{"url":"https://github.com/LINBIT/csync2/pull/13/commits/92742544a56bcbcd9ec99ca15f898b31797e39e2","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/01/msg00003.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15523"},{"url":"https://github.com/advisories/GHSA-hw3p-w63h-mj9c"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-15523","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-15523","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211858-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1147137","tags":["report"]},{"url":"https://bugzilla.suse.com/1147139","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15523","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211952-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-15523","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15523","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N2TJY6NFDWNM4LSW3EQT7J74KIUPFSIZ/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-15523","description":"An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake() function. It neglects to call this function again, as required by the design of the API.","status":"published","published":"2020-12-30T20:04:16Z","modified":"2024-08-05T00:49:13.597Z","updated_at":"2026-11-02T14:20:21.703364Z"}],"euvd":[{"id":"EUVD-2019-6508","description":"An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake() function. It neglects to call this function again, as required by the design of the API.","status":"published","published":"2020-12-30T20:04:16Z","modified":"2024-08-05T00:49:13Z","updated_at":"2026-11-03T02:40:36.129589Z"}],"ghsa":[{"id":"GHSA-hw3p-w63h-mj9c","title":"An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return...","description":"An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake() function. It neglects to call this function again, as required by the design of the API.","status":"published","published":"2022-05-24T17:37:34Z","modified":"2023-01-29T05:05:12Z","cwes":["CWE-252"],"updated_at":"2026-11-02T14:45:43.934947Z"}],"nvd":[{"id":"CVE-2019-15523","description":"An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake() function. It neglects to call this function again, as required by the design of the API.","status":"published","published":"2020-12-30T21:15:12.533Z","modified":"2026-06-17T02:20:32.537Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-252"],"updated_at":"2026-11-02T14:05:48.502374Z"}],"osv":[{"id":"ALPINE-CVE-2019-15523","description":"An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake() function. It neglects to call this function again, as required by the design of the API.","status":"published","published":"2020-12-30T21:15:12.533Z","modified":"2026-11-03T06:31:51.657397659Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2019-15523","description":"An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake() function. It neglects to call this function again, as required by the design of the API.","status":"published","published":"2020-12-30T21:15:12.533Z","modified":"2026-10-20T10:50:45.580720173Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:11.361782Z"},{"id":"DEBIAN-CVE-2019-15523","description":"An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake() function. It neglects to call this function again, as required by the design of the API.","status":"published","published":"2020-12-30T21:15:12.533Z","modified":"2026-09-21T07:02:11.407824492Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"UBUNTU-CVE-2019-15523","description":"An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake() function. It neglects to call this function again, as required by the design of the API.","status":"published","published":"2020-12-30T21:15:00Z","modified":"2025-10-24T04:47:49Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DLA-2515-1","title":"csync2 - security update","status":"published","published":"2021-01-04T00:00:00Z","modified":"2026-03-09T01:18:50.201613Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"openSUSE-SU-2021:0853-1","title":"Security update for csync2","description":"This update for csync2 fixes the following issues:\n\n- CVE-2019-15522: Fixed an issue where daemon fails to enforce TLS (bsc#1147137)\n- CVE-2019-15523: Fixed an incorrect TLS handshake error handling (bsc#1147139)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-06-07T12:06:12Z","modified":"2026-02-04T03:26:40.189818Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10706-1","title":"csync2-2.0+git.1600444747.83b3644-1.3 on GA media","description":"These are all security issues fixed in the csync2-2.0+git.1600444747.83b3644-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:48:16.746463Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:1858-1","title":"Security update for csync2","description":"This update for csync2 fixes the following issues:\n\n- CVE-2019-15522: Fixed an issue where daemon fails to enforce TLS (bsc#1147137)\n- CVE-2019-15523: Fixed an incorrect TLS handshake error handling (bsc#1147139)\n","status":"published","published":"2021-06-04T07:02:37Z","modified":"2026-02-04T02:32:14.837305Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1952-1","title":"Security update for csync2","description":"This update for csync2 fixes the following issues:\n\n- CVE-2019-15522: Fixed an issue where daemon fails to enforce TLS (bsc#1147137)\n- CVE-2019-15523: Fixed an incorrect TLS handshake error handling (bsc#1147139)\n","status":"published","published":"2021-06-10T14:18:44Z","modified":"2026-02-04T02:55:08.291283Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}