Cryptographic issues in OpenSSL - CVE-2019-1547

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU21043

Cryptographic issues in OpenSSL - CVE-2019-1547

Published: September 11, 2019


Vulnerability identifier: #VU21043
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-1547
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to decrypt traffic.

The vulnerability exists due to insufficient enforcement of side channel resistant code paths. A remote attacker with ability to create a large number of signatures, where explicit parameters with no co-factor is present, can force the application to fall back to non-side channel resistant code pathsduring ECDSA signature operation and perform full key recovery.

Successful exploitation of the vulnerability may allow an attacker to decrypt communication between server and client.


Affected software

OpenSSL
Gentoo Linux
Fedora
IBM AIX
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Ubuntu
Slackware Linux
Opensuse
JBoss Core Services
JD Edwards World Security
Tenable.sc
openssl (Alpine package)
openssl1.0 (Debian package)
openssl (Ubuntu package)
jbcs-httpd24-brotli (Red Hat package)
openssl (Debian package)
jbcs-httpd24-apr (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-httpd (Red Hat package)
libssl1.0.0 (Ubuntu package)
openssl11
openssl (Red Hat package)
openssl
APM Edge
Watson Speech to Text, Text to Speech
EMC ECS
Storage Protect Client
MySQL Enterprise Backup
JD Edwards EnterpriseOne Tools
Oracle Secure Global Desktop
MySQL Server
Oracle Essbase
IBM Qradar SIEM
Oracle Endeca Server
IBM PureData System for Operational Analytics
IBM Netezza Performance Server
NetWorker
PeopleSoft Enterprise PeopleTools
IBM Cognos Analytics
Oracle API Gateway
Oracle Enterprise Manager Ops Center
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)
EMC Data Domain

How to mitigate CVE-2019-1547

Install updates from vendor's website.

OpenSSL - addressed in versions 1.0.2t, 1.1.0l, 1.1.1d
Tenable.sc - update to 5.13.0
APM Edge - update to 4.0
openssl (Alpine package) - addressed in versions 1.0.2t-r0, 1.1.1d-r0
openssl1.0 (Debian package) - update to 1.0.2t-1~deb9u1
openssl (Ubuntu package) - addressed in versions 1.0.2g-1ubuntu4.16, 1.1.1c-1ubuntu4.1, 1.1.1-1ubuntu2.1~18.04.6
jbcs-httpd24-brotli (Red Hat package) - addressed in versions 1.0.6-21.jbcs.el6, 1.0.6-21.jbcs.el7
openssl (Debian package) - addressed in versions 1.1.0l-1~deb9u1, 1.1.1d-0+deb10u1
jbcs-httpd24-apr (Red Hat package) - addressed in versions 1.6.3-86.jbcs.el6, 1.6.3-86.jbcs.el7
jbcs-httpd24-mod_http2 (Red Hat package) - addressed in versions 1.11.3-22.jbcs.el6, 1.11.3-22.jbcs.el7
jbcs-httpd24-httpd (Red Hat package) - addressed in versions 2.4.37-52.jbcs.el6, 2.4.37-52.jbcs.el7
MySQL Enterprise Backup - addressed in versions 3.12.5, 4.1.4
MySQL Server - addressed in versions 5.6.47, 5.7.27, 8.0.19
IBM Qradar SIEM - update to 7.5.0 Update Pack 8
libssl1.0.0 (Ubuntu package) - addressed in versions 1.0.1f-1ubuntu2.27+esm1, 1.0.1-4ubuntu5.44, 1.0.2g-1ubuntu4.17, 1.0.2n-1ubuntu5.4
IBM PureData System for Operational Analytics - update to 1.1 FP5
openssl11 - update to 1.1.1c-2.el7
openssl (Red Hat package) - update to 1.1.1c-15.el8
openssl - addressed in versions 1.1.1d-1.fc29, 1.1.1d-1.fc30, 1.1.1d-1.fc31
Watson Speech to Text, Text to Speech - update to 1.1.2
EMC ECS - update to 3.5.0.1
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.3.0.5.014
Dell EMC Unity Operating Environment (OE) - update to 5.0.3.0.5.014
EMC Data Domain - addressed in versions 6.1.2.70, 6.2.1.0, 7.0.0.20
Storage Protect Client - update to 8.1.20.0
IBM Cognos Analytics - addressed in versions 11.1.7 Fix Pack 8, 11.2.4 FP3, 12.0.2
IBM Netezza Performance Server - update to 11.2.1.11
NetWorker - update to 19.10.0.0

External References

Related Security Bulletins