Use of a broken or risky cryptographic algorithm in OpenSSL - CVE-2019-1559

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU17860

Use of a broken or risky cryptographic algorithm in OpenSSL - CVE-2019-1559

Published: February 26, 2019 / Updated: June 24, 2022


Vulnerability identifier: #VU17860
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-1559
CWE-ID: CWE-327
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to decrypt sensitive information.

The vulnerability exists due to the way an application behaves, when it receives a 0-byte record with invalid padding compared to the record with an invalid MAC, which results in padding oracle. A remote attacker can decrypt data.

Successful exploitation of the vulnerability requires that the application is using "non-stitched" ciphersuites and calls SSL_shutdown() twice (first, via a BAD_RECORD_MAC and again via a CLOSE_NOTIFY). 



Affected software

OpenSSL
Gentoo Linux
Amazon Linux AMI
Arch Linux
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Palo Alto PAN-OS
Ubuntu
Opensuse
Fedora
EMC Isilon OneFS
Brocade SANnav
JD Edwards EnterpriseOne Tools
Services Tools Bundle
JD Edwards World Security
openssl1.0 (Debian package)
openssl (Alpine package)
openssl (Ubuntu package)
openssl1.0 (Ubuntu package)
libssl1.0.0 (Ubuntu package)
compat-openssl10
HPE SANnav Management Software
Tivoli Network Manager IP Edition
Oracle Business Intelligence Enterprise Edition
Connectrix (Brocade)
EMC ECS
Data Computing Appliance (DCA)
Flex System Fabric EN4093/EN4093R 10Gb Scalable Switch
Dell PowerProtect Cyber Recovery
Red Hat Virtualization Host
Red Hat Virtualization
JBoss Enterprise Web Server
Oracle Communications Unified Session Manager
Oracle Communications Session Router
Oracle Endeca Server
Oracle Communications Diameter Signaling Router (DSR)
Oracle Communications Performance Intelligence Center (PIC) Software
Enterprise Manager Base Platform
IBM PureData System for Operational Analytics
NetWorker
MySQL Workbench
PeopleSoft Enterprise PeopleTools
Oracle API Gateway
Oracle Enterprise Manager Ops Center
Orion Platform
LCM8 & LCM16 KVM Switch Firmware
GCM16 & GCM32 KVM Switch Firmware
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)
IBM Flex System EN2092 1Gb Ethernet Scalable Switch
IBM Flex System Fabric SI4093 GbFSIM 10Gb Scalable Switch
IBM Flex System CN4093 10Gb Converged Scalable Switch

How to mitigate CVE-2019-1559

Install updates from vendor's website.

OpenSSL - update to 1.0.2r
Brocade SANnav - addressed in versions 2.1.1.8, 2.2.0.2
openssl1.0 (Debian package) - update to 1.0.2r-1~deb9u1
openssl (Alpine package) - update to 1.0.2r-r0
openssl (Ubuntu package) - update to 1.0.2g-1ubuntu4.15
openssl1.0 (Ubuntu package) - addressed in versions 1.0.2n-1ubuntu5.3, 1.0.2n-1ubuntu6.2
HPE SANnav Management Software - addressed in versions 2.1.1.8, 2.2.0.2
JBoss Enterprise Web Server - update to 5.2.0
Palo Alto PAN-OS - addressed in versions 7.1.25, 8.0.20, 8.1.11, 9.0.5
MySQL Workbench - update to 8.0.17
Orion Platform - update to 2024.2
libssl1.0.0 (Ubuntu package) - addressed in versions 1.0.1f-1ubuntu2.27+esm1, 1.0.1-4ubuntu5.44
compat-openssl10 - addressed in versions 1.0.2o-7.fc29, 1.0.2o-7.fc30, 1.0.2o-8.fc31
IBM PureData System for Operational Analytics - update to 1.1 FP5
LCM8 & LCM16 KVM Switch Firmware - update to 1.2.50.00
Connectrix (Brocade) - addressed in versions 2.1.1.8, 2.2.0.2
GCM16 & GCM32 KVM Switch Firmware - update to 2.4.0.25463
EMC ECS - update to 3.5.0.1
Data Computing Appliance (DCA) - update to 3.5.4.0
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.3.0.5.014
Dell EMC Unity Operating Environment (OE) - update to 5.0.3.0.5.014
IBM Flex System EN2092 1Gb Ethernet Scalable Switch - update to 7.8.25.0
IBM Flex System Fabric SI4093 GbFSIM 10Gb Scalable Switch - update to 7.8.25.0
IBM Flex System CN4093 10Gb Converged Scalable Switch - update to 7.8.25.0
Flex System Fabric EN4093/EN4093R 10Gb Scalable Switch - update to 7.8.25.0
Dell PowerProtect Cyber Recovery - update to 18.1.1.2-8
NetWorker - update to 19.10.0.0

External References

Related Security Bulletins