Cryptographic issues in OpenSSL - CVE-2019-1551

Vulnerability identifier: #VU23451

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-1551

CWE-ID: CWE-310

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to an overflow issue within the rsaz_512_sqr(): the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. A remote attacker can perform an attack against DH512 keys.

OpenSSL
Gentoo Linux
Fedora
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Slackware Linux
Opensuse
Ubuntu
openssl (Red Hat package)
openssl (Alpine package)
openssl (Ubuntu package)
libssl1.0.0 (Ubuntu package)
openssl1.0 (Debian package)
openssl (Debian package)
openssl11
openssl
Tenable.sc
Red Hat OpenShift Serverless
OpenShift Data Foundation (formerly OpenShift Container Storage)
Helm
MySQL Enterprise Monitor
IBM Qradar SIEM
Oracle Enterprise Manager Ops Center
IBM PureData System for Operational Analytics
NetWorker
EMC ECS
EMC Data Domain
Contrail Networking

Install update from vendor's website.

OpenSSL - addressed in versions 1.0.2u, 1.1.1e
openssl (Red Hat package) - update to 1.1.1g-11.el8
Tenable.sc - addressed in versions 5.13.0, 5.17.0
Red Hat OpenShift Serverless - update to 1.11.0
Helm - update to 2.16.2
MySQL Enterprise Monitor - update to 8.0.21
IBM Qradar SIEM - update to 7.5.0 Update Pack 8
openssl (Alpine package) - addressed in versions 1.0.2u-r0, 1.1.1d-r2
openssl (Ubuntu package) - addressed in versions 1.0.2g-1ubuntu4.16, 1.1.1-1ubuntu2.1~18.04.6, 1.1.1c-1ubuntu4.1
libssl1.0.0 (Ubuntu package) - update to 1.0.2n-1ubuntu5.4
openssl1.0 (Debian package) - update to 1.0.2u-1~deb9u1
openssl (Debian package) - update to 1.1.1d-0+deb10u5
openssl11 - update to 1.1.1g-1.el7
openssl - addressed in versions 1.1.1g-1.fc30, 1.1.1g-1.fc31, 1.1.1g-1.fc32
IBM PureData System for Operational Analytics - update to 1.1 FP5
EMC ECS - update to 3.5.0.1
EMC Data Domain - addressed in versions 6.1.2.70, 6.2.1.0, 7.0.0.20
NetWorker - update to 19.10.0.0
Contrail Networking - update to R22.3

• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98
• https://www.openssl.org/news/secadv/20191206.txt

• Information disclosure in OpenSSL
• Slackware Linux update for openssl
• Debian update for openssl1.0
• Multiple vulnerabilities in Tenable.sc
• OpenSUSE Linux update for openssl-1_1
• Helm update for OpenSSL
• Gentoo update for OpenSSL
• Ubuntu update for OpenSSL
• Multiple vulnerabilities in Oracle Enterprise Manager Ops Center
• Multiple vulnerabilities in MySQL Enterprise Monitor
• Cryptographic issues in openssl (Alpine package)
• Red Hat Enterprise Linux 8 update for openssl
• Multiple vulnerabilities in Red Hat Openshift Serverless
• Multiple vulnerabilities in Tenable.sc
• Multiple vulnerabilities in Red Hat OpenShift Container Storage
• Debian update for openssl
• Multiple vulnerabilities in Juniper Networks Contrail Networking
• Multiple vulnerabilities in Dell EMC ECS
• Multiple vulnerabilities in Dell EMC Data Domain
• Multiple vulnerabilities in IBM PureData System for Operational Analytics
• Multiple vulnerabilities in Dell Networker
• Multiple vulnerabilities in IBM QRadar SIEM
• Ubuntu update for openssl
• Fedora 32 update for openssl
• Fedora 30 update for openssl
• Fedora 31 update for openssl
• Fedora EPEL 7 update for openssl11