{"id":"UBUNTU-CVE-2019-5163","details":"An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher and a local_address, arbitrary UDP packets can cause a FATAL error code path and exit. An attacker can send arbitrary UDP packets to trigger this vulnerability.","modified":"2026-04-22T11:58:46.234424Z","published":"2019-12-03T22:15:00Z","upstream":["CVE-2019-5163"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2019-5163"},{"type":"REPORT","url":"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0956"},{"type":"REPORT","url":"https://github.com/shadowsocks/shadowsocks-libev/issues/2536"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2019-5163"}],"affected":[{"package":{"name":"shadowsocks-libev","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/shadowsocks-libev@3.1.3+ds-1ubuntu2?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.8+ds-2","3.1.0+ds-3","3.1.0+ds-4","3.1.0+ds-5","3.1.1+ds-1","3.1.1+ds-2","3.1.1+ds-3","3.1.3+ds-1ubuntu1","3.1.3+ds-1ubuntu2"],"ecosystem_specific":{"binaries":[{"binary_name":"libshadowsocks-libev2","binary_version":"3.1.3+ds-1ubuntu2"},{"binary_name":"shadowsocks-libev","binary_version":"3.1.3+ds-1ubuntu2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-5163.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}