HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2019-14899

CVSS 7.4v3.1pub. 2019-12-11upd. 2024-11-21

A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user, to determine if a connected user is using a VPN, make positive inferences about the websites they are visiting, and determine the correct sequence and acknowledgement numbers in use, allowing the bad actor to inject data into the TCP stream. This provides everything that is needed for an attacker to hijack active connections inside the VPN tunnel.

CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

  • Apple iPadOS

    OS
    Apple
    < 13.6

  • Apple iOS

    OS
    Apple
    < 13.6

  • Apple macOS

    OS
    Apple
    11.0

  • Apple Mac Os X

    OS
    Apple
    < 10.15.6

  • Apple tvOS

    OS
    Apple
    < 13.4.8

  • Freebsd

    OS
    Freebsd
    wszystkie wersje

  • Linux Kernel

    OS
    Linux
    wszystkie wersje

  • Openbsd

    OS
    Openbsd
    wszystkie wersje
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
VPN
CWE
References

Related vulnerabilities

CVE-2025-10585CRITICAL9.8⚠ KEVPL ✓ten sam produkt

Type confusion w V8 (Google Chrome) — zdalne uszkodzenie sterty

CVE-2025-43300CRITICAL10.0⚠ KEVPL ✓ten sam produkt

Apple iOS/iPadOS/macOS — out-of-bounds write przy przetwarzaniu obrazu

CVE-2025-34028CRITICAL9.3⚠ KEVPL ✓ten sam produkt

Commvault Command Center – nieuwierzytelniony RCE przez path traversal w ZIP

CVE-2025-31201CRITICAL9.8⚠ KEVPL ✓ten sam produkt

Apple: Obejście Pointer Authentication w iOS, macOS i innych platformach

CVE-2025-31200CRITICAL9.8⚠ KEVPL ✓ten sam produkt

Apple — memory corruption (RCE) w przetwarzaniu strumieni audio