CVE catalog

CVE-2019-20795

iproute2: CVE-2019-20795

Severity: Medium · CVSS 4.4CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Published: May 5, 2019, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.40% · Oct 25, 2026

iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	iproute2	sid	`7.3.0-1`	fixed
Debian	iproute2	forky	`7.2.0-1`	fixed
Debian	iproute2	trixie	`6.15.0-1`	fixed
Debian	iproute2	bookworm	`6.1.0-3`	fixed
Cpe	iproute2	Not reported	`5.1.0`	fixed
Cpe	ubuntu_linux	Not reported	Not reported	unknown
Alpine	iproute2	3.10	`4.20.0-r2`	fixed
Alpine	iproute2	3.11	`5.1.0-r0`	fixed
Alpine	iproute2	3.12	`5.1.0-r0`	fixed
Alpine	iproute2	3.13	`5.1.0-r0`	fixed
Alpine	iproute2	3.14	`5.1.0-r0`	fixed
Alpine	iproute2	3.15	`5.1.0-r0`	fixed
Alpine	iproute2	3.16	`5.1.0-r0`	fixed
Alpine	iproute2	3.17	`5.1.0-r0`	fixed
Alpine	iproute2	3.18	`5.1.0-r0`	fixed
Alpine	iproute2	3.19	`5.1.0-r0`	fixed
Alpine	iproute2	3.20	`5.1.0-r0`	fixed
Alpine	iproute2	3.21	`5.1.0-r0`	fixed
Alpine	iproute2	3.22	`5.1.0-r0`	fixed
Alpine	iproute2	3.23	`5.1.0-r0`	fixed
Alpine	iproute2	3.24	`5.1.0-r0`	fixed
Alpine	iproute2	3.9	`4.19.0-r1`	fixed
Ubuntu	iproute2	18.04	`4.9.0-1ubuntu2`	vulnerable
Ubuntu	iproute2	18.04	`4.9.0-1ubuntu3`	vulnerable
Ubuntu	iproute2	18.04	`4.14.1-0ubuntu2`	vulnerable
Ubuntu	iproute2	18.04	`4.14.1-0ubuntu3`	vulnerable
Ubuntu	iproute2	18.04	`4.15.0-2ubuntu1`	vulnerable
Ubuntu	iproute2	18.04	`4.15.0-2ubuntu1.1`	fixed
Ubuntu	iproute2	18.04	`4.9.0-1ubuntu2`	vulnerable
Ubuntu	iproute2	18.04	`4.9.0-1ubuntu3`	vulnerable
Ubuntu	iproute2	18.04	`4.14.1-0ubuntu2`	vulnerable
Ubuntu	iproute2	18.04	`4.14.1-0ubuntu3`	vulnerable
Ubuntu	iproute2	18.04	`4.15.0-2ubuntu1`	vulnerable
Ubuntu	iproute2	18.04	`4.15.0-2ubuntu1.1`	fixed
Suse	iproute2	linux enterprise software development kit 12 sp5	`4.12-16.6.1`	fixed
Suse	iproute2	linux enterprise server 12 sp5	`4.12-16.6.1`	fixed
Suse	iproute2	linux enterprise server for sap applications 12 sp5	`4.12-16.6.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	iproute2	source	sid	`5.2.0-1`	not yet assigned	Not reported	Not reported
Debian	iproute2	source	forky	`5.2.0-1`	not yet assigned	Not reported	Not reported
Debian	iproute2	source	trixie	`5.2.0-1`	not yet assigned	Not reported	Not reported
Debian	iproute2	source	bookworm	`5.2.0-1`	not yet assigned	Not reported	Not reported
Cpe	iproute2	cpe	Not reported	`5.1.0`	Not reported	NVD-CVE-2019-20795	Not reported
Alpine	iproute2	apk	3.10	`4.20.0-r2`	Not reported	ALPINE-CVE-2019-20795	Not reported
Alpine	iproute2	apk	3.11	`5.1.0-r0`	Not reported	ALPINE-CVE-2019-20795	Not reported
Alpine	iproute2	apk	3.12	`5.1.0-r0`	Not reported	ALPINE-CVE-2019-20795	Not reported
Alpine	iproute2	apk	3.13	`5.1.0-r0`	Not reported	ALPINE-CVE-2019-20795	Not reported
Alpine	iproute2	apk	3.14	`5.1.0-r0`	Not reported	ALPINE-CVE-2019-20795	Not reported
Alpine	iproute2	apk	3.15	`5.1.0-r0`	Not reported	ALPINE-CVE-2019-20795	Not reported
Alpine	iproute2	apk	3.16	`5.1.0-r0`	Not reported	ALPINE-CVE-2019-20795	Not reported
Alpine	iproute2	apk	3.17	`5.1.0-r0`	Not reported	ALPINE-CVE-2019-20795	Not reported
Alpine	iproute2	apk	3.18	`5.1.0-r0`	Not reported	ALPINE-CVE-2019-20795	Not reported
Alpine	iproute2	apk	3.19	`5.1.0-r0`	Not reported	ALPINE-CVE-2019-20795	Not reported
Alpine	iproute2	apk	3.20	`5.1.0-r0`	Not reported	ALPINE-CVE-2019-20795	Not reported
Alpine	iproute2	apk	3.21	`5.1.0-r0`	Not reported	ALPINE-CVE-2019-20795	Not reported
Alpine	iproute2	apk	3.22	`5.1.0-r0`	Not reported	ALPINE-CVE-2019-20795	Not reported
Alpine	iproute2	apk	3.23	`5.1.0-r0`	Not reported	ALPINE-CVE-2019-20795	Not reported
Alpine	iproute2	apk	3.24	`5.1.0-r0`	Not reported	ALPINE-CVE-2019-20795	Not reported
Alpine	iproute2	apk	3.9	`4.19.0-r1`	Not reported	ALPINE-CVE-2019-20795	Not reported
Ubuntu	iproute2	deb	18.04	`4.15.0-2ubuntu1.1`	Not reported	USN-4357-1	Not reported
Ubuntu	iproute2	deb	18.04	`4.15.0-2ubuntu1.1`	Not reported	UBUNTU-CVE-2019-20795	Not reported
Suse	iproute2	rpm	linux enterprise software development kit 12 sp5	`4.12-16.6.1`	Not reported	SUSE-SU-2021:3452-1	Not reported
Suse	iproute2	rpm	linux enterprise server 12 sp5	`4.12-16.6.1`	Not reported	SUSE-SU-2021:3452-1	Not reported
Suse	iproute2	rpm	linux enterprise server for sap applications 12 sp5	`4.12-16.6.1`	Not reported	SUSE-SU-2021:3452-1	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[iproute2]Fixed
Details (4)
- 6.1.0-3 · amd64 · bookworm
  Fixed · Fixed: 5.2.0-1
  dsa · iproute2 · debian · bookworm
- 6.1.0-3 · arm64 · bookworm
  Fixed · Fixed: 5.2.0-1
  dsa · iproute2 · debian · bookworm
- 6.15.0-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 5.2.0-1
  dsa · iproute2 · debian · bookworm
- 6.15.0-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 5.2.0-1
  dsa · iproute2 · debian · bookworm
[iproute2-doc]Fixed
Source package: [iproute2]
Details (2)
- 6.1.0-3 · all · bookworm
  Fixed · Fixed: 5.2.0-1
  dsa · iproute2 · debian · bookworm
- 6.1.0-3 · all · bookworm
  Fixed · Fixed: 5.2.0-1
  dsa · iproute2 · debian · bookworm

Observed: Oct 23, 2026, 5:43:51 PM UTC

References

[CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]