CVE catalog

CVE-2019-15522

csync2: CVE-2019-15522

[CVE catalog]

Severity
High · CVSS 7.3CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.90% · Oct 25, 2026

An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a failure of a hello command when the configuration requires use of SSL.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancsync2sid2.0-42-g83b3644-7fixed
Debiancsync2forky2.0-42-g83b3644-7fixed
Debiancsync2trixie2.0-42-g83b3644-3fixed
Debiancsync2bookworm2.0-42-g83b3644-2fixed
Opensusecsync2leap 15.22.0+git.1461714863.10636a4-lp152.5.3.1fixed
Susecsync2linux enterprise high availability extension 11 sp41.34-0.13.7.1fixed
Susecsync2linux enterprise high availability extension 12 sp32.0+git.1368794815.cf835a7-3.9.5fixed
Susecsync2linux enterprise high availability extension 12 sp42.0+git.1368794815.cf835a7-3.9.5fixed
Susecsync2linux enterprise high availability extension 12 sp52.0+git.1368794815.cf835a7-3.9.5fixed
Opensusecsync2tumbleweed2.0+git.1600444747.83b3644-1.3fixed
Susecsync2linux enterprise high availability extension 152.0+git.1461714863.10636a4-4.6.1fixed
Susecsync2linux enterprise high availability extension 15 sp12.0+git.1461714863.10636a4-4.6.1fixed
Susecsync2linux enterprise high availability extension 15 sp22.0+git.1461714863.10636a4-4.6.1fixed
Ubuntucsync216.042.0+73d3293-2vulnerable
Ubuntucsync216.042.0+73d3293-2build1vulnerable
Ubuntucsync216.042.0+73d3293-2build2vulnerable
Ubuntucsync218.042.0-8-g175a01c-4ubuntu1vulnerable
Ubuntucsync220.042.0-8-g175a01c-4ubuntu2vulnerable
Ubuntucsync220.042.0-22-gce67c55-1ubuntu1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancsync2sourcesid2.0-25-gc0faaf9-1not yet assignedNot reported[955445]
Debiancsync2sourceforky2.0-25-gc0faaf9-1not yet assignedNot reported[955445]
Debiancsync2sourcetrixie2.0-25-gc0faaf9-1not yet assignedNot reported[955445]
Debiancsync2sourcebookworm2.0-25-gc0faaf9-1not yet assignedNot reported[955445]
Opensusecsync2rpmleap 15.22.0+git.1461714863.10636a4-lp152.5.3.1Not reportedOPENSUSE-SU-2021:0853-1Not reported
Susecsync2rpmlinux enterprise high availability extension 11 sp41.34-0.13.7.1Not reportedSUSE-SU-2021:14763-1Not reported
Susecsync2rpmlinux enterprise high availability extension 12 sp32.0+git.1368794815.cf835a7-3.9.5Not reportedSUSE-SU-2021:1952-1Not reported
Susecsync2rpmlinux enterprise high availability extension 12 sp42.0+git.1368794815.cf835a7-3.9.5Not reportedSUSE-SU-2021:1952-1Not reported
Susecsync2rpmlinux enterprise high availability extension 12 sp52.0+git.1368794815.cf835a7-3.9.5Not reportedSUSE-SU-2021:1952-1Not reported
Opensusecsync2rpmtumbleweed2.0+git.1600444747.83b3644-1.3Not reportedOPENSUSE-SU-2024:10706-1Not reported
Susecsync2rpmlinux enterprise high availability extension 152.0+git.1461714863.10636a4-4.6.1Not reportedSUSE-SU-2021:1858-1Not reported
Susecsync2rpmlinux enterprise high availability extension 15 sp12.0+git.1461714863.10636a4-4.6.1Not reportedSUSE-SU-2021:1858-1Not reported
Susecsync2rpmlinux enterprise high availability extension 15 sp22.0+git.1461714863.10636a4-4.6.1Not reportedSUSE-SU-2021:1858-1Not reported

[Debian bug #955445]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [csync2]Fixed
    Details (2)

    • 2.0-42-g83b3644-2 · amd64 · bookworm

      Fixed · Fixed: 2.0-25-gc0faaf9-1

      dsa · csync2 · debian · bookworm; dsa · csync2 · debian · 12

    • 2.0-42-g83b3644-2 · arm64 · bookworm

      Fixed · Fixed: 2.0-25-gc0faaf9-1

      dsa · csync2 · debian · bookworm; dsa · csync2 · debian · 12

[Debian 13 (Trixie)]

  • [csync2]Fixed
    Details (2)

    • 2.0-42-g83b3644-3 · amd64 · trixie

      Fixed · Fixed: 2.0-25-gc0faaf9-1

      dsa · csync2 · debian · 13

    • 2.0-42-g83b3644-3 · arm64 · trixie

      Fixed · Fixed: 2.0-25-gc0faaf9-1

      dsa · csync2 · debian · 13

[openSUSE Tumbleweed]

  • [csync2]Fixed

    Source package: [csync2]

    Details (1)

    • 2.0+git.1600444747.83b3644-3.4 · x86_64 · tumbleweed

      Fixed · Fixed: 2.0+git.1600444747.83b3644-1.3

      dsa · csync2 · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]