What’s Vulnerable › Vulnerabilities
CVE-2019-11578
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-04-28 · updated 2026-06-17
- Weakness: CWE-203
Description
auth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks.
Affected products
- NetworkConfiguration dhcpcd: before 7.2.1 — fixed in 7.2.1
How to fix
Upgrade to a fixed version: NetworkConfiguration dhcpcd 7.2.1. Check the vendor advisory for mitigations.
References
- http://www.securityfocus.com/bid/108090
- https://roy.marples.name/archives/dhcpcd-discuss/0002415.html
- https://roy.marples.name/git/dhcpcd.git/commit/?id=7121040790b611ca3fbc400a1bbcd4364ef57233
- https://roy.marples.name/git/dhcpcd.git/commit/?id=aee631aadeef4283c8a749c1caf77823304acf5e
- https://roy.marples.name/git/dhcpcd.git/commit/?id=cfde89ab66cb4e5957b1c4b68ad6a9449e2784da
- http://www.securityfocus.com/bid/108090
- https://roy.marples.name/archives/dhcpcd-discuss/0002415.html
- https://roy.marples.name/git/dhcpcd.git/commit/?id=7121040790b611ca3fbc400a1bbcd4364ef57233
- https://roy.marples.name/git/dhcpcd.git/commit/?id=aee631aadeef4283c8a749c1caf77823304acf5e
- https://roy.marples.name/git/dhcpcd.git/commit/?id=cfde89ab66cb4e5957b1c4b68ad6a9449e2784da
Get alerted when CVE-2019-11578 or the next vulnerability affects your stack