CVE-2019-5289 Denial of service in ManageOne

High 7.5 Published 13 Nov 2019 Updated 4 Aug 2024

Attackers can crash the standby database node by sending invalid packets due to insufficient length checks in Gauss100 OLTP.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-5289?

CVE-2019-5289 is a high-severity denial of service vulnerability in ManageOne, published on 13 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Gauss100 OLTP database in ManageOne with versions of 6.5.0 have an out-of-bounds read vulnerability due to the insufficient checks of the specific packet length. Attackers can construct invalid packets to attack the active and standby communication channels. Successful exploit of this vulnerability could allow the attacker to crash the database on the standby node.

Weakness: CWE-125

Which versions are affected by CVE-2019-5289?

It affects 1 product.

Products include Huawei Manageone.

How do I fix CVE-2019-5289?

No fix has been published for CVE-2019-5289 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-5289 being exploited?

There is no known exploitation of CVE-2019-5289 in the wild and no public exploit code.

Sources

Also known as GHSA-4g65-5v3f-q9xx.