HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2019-14899

CVSS 7.4v3.1pub. 2019-12-11upd. 2024-11-21

A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user, to determine if a connected user is using a VPN, make positive inferences about the websites they are visiting, and determine the correct sequence and acknowledgement numbers in use, allowing the bad actor to inject data into the TCP stream. This provides everything that is needed for an attacker to hijack active connections inside the VPN tunnel.

CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

  • Apple iPadOS

    OS
    Apple
    < 13.6

  • Apple iOS

    OS
    Apple
    < 13.6

  • Apple macOS

    OS
    Apple
    11.0

  • Apple Mac Os X

    OS
    Apple
    < 10.15.6

  • Apple tvOS

    OS
    Apple
    < 13.4.8

  • Freebsd

    OS
    Freebsd
    all versions

  • Linux Kernel

    OS
    Linux
    all versions

  • Openbsd

    OS
    Openbsd
    all versions
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
VPN
CWE
References

Related vulnerabilities

CVE-2026-65400CRITICAL9.8⚠ KEVPL ✓same product

Pominięcie uwierzytelniania w Screen Sharing na macOS

CVE-2025-10585CRITICAL9.8⚠ KEVPL ✓same product

Type confusion w V8 (Google Chrome) — zdalne uszkodzenie sterty

CVE-2025-43300CRITICAL10.0⚠ KEVPL ✓same product

Apple iOS/iPadOS/macOS — out-of-bounds write przy przetwarzaniu obrazu

CVE-2025-34028CRITICAL9.3⚠ KEVPL ✓same product

Commvault Command Center – nieuwierzytelniony RCE przez path traversal w ZIP

CVE-2025-31201CRITICAL9.8⚠ KEVPL ✓same product

Apple: Obejście Pointer Authentication w iOS, macOS i innych platformach