CVE-2019-18792

An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet. The fake FIN packet is injected just before the PUSH ACK packet we want to bypass. The PUSH ACK packet (containing the data) will be ignored by Suricata because it overlaps the FIN packet (the sequence and ack number are identical in the two packets). The client will ignore the fake FIN packet because the ACK flag is not set. Both linux and windows clients are ignoring the injected packet.

• CWE-436

• https://github.com/OISF/suricata/commit/1c63d3905852f746ccde7e2585600b2199cefb4bPatch, Third Party Advisory
• https://github.com/OISF/suricata/commit/fa692df37a796c3330c81988d15ef1a219afc006Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/01/msg00032.htmlThird Party Advisory
• https://redmine.openinfosecfoundation.org/issues/3324Exploit, Third Party Advisory
• https://redmine.openinfosecfoundation.org/issues/3394Exploit, Third Party Advisory
• https://github.com/OISF/suricata/commit/1c63d3905852f746ccde7e2585600b2199cefb4bPatch, Third Party Advisory
• https://github.com/OISF/suricata/commit/fa692df37a796c3330c81988d15ef1a219afc006Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/01/msg00032.htmlThird Party Advisory
• https://redmine.openinfosecfoundation.org/issues/3324Exploit, Third Party Advisory
• https://redmine.openinfosecfoundation.org/issues/3394Exploit, Third Party Advisory

Published

Jan 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18784SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x version…9.8
• CVE-2019-18785SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 …7.5
• CVE-2019-18786In the Linux kernel through 5.3.8, f->fmt.sdr.reserved is un…5.5
• CVE-2019-1879A vulnerability in the CLI of Cisco Integrated Management Co…6.4
• CVE-2019-18790An issue was discovered in channels/chan_sip.c in Sangoma As…6.5
• CVE-2019-18791Lexmark printer MS812 and multiple older generation Lexmark …5.4
• CVE-2019-18793Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR…6.1
• CVE-2019-18794The BASS Audio Library 2.4.14 under Windows is prone to a BA…6.5
• CVE-2019-18795The BASS Audio Library 2.4.14 under Windows is prone to a BA…6.5
• CVE-2019-18796The BASS Audio Library 2.4.14 under Windows is prone to a BA…6.5
• CVE-2019-18797LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::oper…6.5
• CVE-2019-18798LibSass before 3.6.3 allows a heap-based buffer over-read in…6.5