CVE-2019-1559
Medium
Description
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).
SeverityMedium
CVSS5.9
Exploit probability—
Product
Openssl
PublishedFeb 27, 2019
First seenFeb 27, 2019
How to fix
Update
- openssl openssl1.0.2r or later
- mcafee data_exchange_layer6.0.0 or later
- mcafee threat_intelligence_exchange_server3.0.0 or later
- mcafee web_gateway9.0.0 or later
- paloaltonetworks pan-os7.1.15, 8.0.20, 8.1.8, 9.0.2 or later
- nodejs node.js6.17.0, 8.15.1 or later
Vendor advisories
- security.gentoo.org/glsa/201903-10
- usn.ubuntu.com/3899-1/
- debian.org/security/2019/dsa-4400
- access.redhat.com/errata/RHSA-2019:2304
- access.redhat.com/errata/RHSA-2019:2439
- access.redhat.com/errata/RHSA-2019:2437
- access.redhat.com/errata/RHSA-2019:2471
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/
- access.redhat.com/errata/RHSA-2019:3929
- access.redhat.com/errata/RHSA-2019:3931
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openssl openssl | 1.0.2 ≤ v < 1.0.2r | 1.0.2r |
| canonical ubuntu_linux | 16.04, 18.04, 18.10 | — |
| debian debian_linux | 8.0, 9.0 | — |
| netapp active_iq_unified_manager | 7.3 ≤ v, 9.5 ≤ v, No range specified | — |
| netapp altavault | No range specified | — |
| netapp cloud_backup | No range specified | — |
| netapp clustered_data_ontap_antivirus_connector | No range specified | — |
| netapp element_software | No range specified | — |
| netapp hci_management_node | No range specified | — |
| netapp hyper_converged_infrastructure | No range specified | — |
| netapp oncommand_insight | No range specified | — |
| netapp oncommand_unified_manager | No range specified | — |
| netapp oncommand_unified_manager_core_package | No range specified | — |
| netapp oncommand_workflow_automation | No range specified | — |
| netapp ontap_select_deploy | No range specified | — |
| netapp ontap_select_deploy_administration_utility | No range specified | — |
| netapp santricity_smi-s_provider | No range specified | — |
| netapp service_processor | No range specified | — |
| netapp smi-s_provider | No range specified | — |
| netapp snapcenter | No range specified | — |
| netapp snapdrive | No range specified | — |
| netapp snapprotect | No range specified | — |
| netapp solidfire | No range specified | — |
| netapp steelstore_cloud_integrated_storage | No range specified | — |
| netapp storage_automation_store | No range specified | — |
| netapp storagegrid | 9.0.0 ≤ v ≤ 9.0.4, No range specified | — |
| netapp hci_compute_node | No range specified | — |
| f5 big-ip_access_policy_manager | 12.1.0 ≤ v ≤ 12.1.5, 13.0.0 ≤ v ≤ 13.1.3, 14.0.0 ≤ v ≤ 14.1.2, 15.0.0 ≤ v ≤ 15.1.0 | — |
| f5 big-ip_advanced_firewall_manager | 12.1.0 ≤ v ≤ 12.1.5, 13.0.0 ≤ v ≤ 13.1.3, 14.0.0 ≤ v ≤ 14.1.2, 15.0.0 ≤ v ≤ 15.1.0 | — |
| f5 big-ip_analytics | 12.1.0 ≤ v ≤ 12.1.5, 13.0.0 ≤ v ≤ 13.1.3, 14.0.0 ≤ v ≤ 14.1.2, 15.0.0 ≤ v ≤ 15.1.0 | — |
| f5 big-ip_application_acceleration_manager | 12.1.0 ≤ v ≤ 12.1.5, 13.0.0 ≤ v ≤ 13.1.3, 14.0.0 ≤ v ≤ 14.1.2, 15.0.0 ≤ v ≤ 15.1.0 | — |
| f5 big-ip_application_security_manager | 12.1.0 ≤ v ≤ 12.1.5, 13.0.0 ≤ v ≤ 13.1.3, 14.0.0 ≤ v ≤ 14.1.2, 15.0.0 ≤ v ≤ 15.1.0 | — |
| f5 big-ip_domain_name_system | 12.1.0 ≤ v ≤ 12.1.5, 13.0.0 ≤ v ≤ 13.1.3, 14.0.0 ≤ v ≤ 14.1.2, 15.0.0 ≤ v ≤ 15.1.0 | — |
| f5 big-ip_edge_gateway | 12.1.0 ≤ v ≤ 12.1.5, 13.0.0 ≤ v ≤ 13.1.3, 14.0.0 ≤ v ≤ 14.1.2, 15.0.0 ≤ v ≤ 15.1.0 | — |
| f5 big-ip_fraud_protection_service | 12.1.0 ≤ v ≤ 12.1.5, 13.0.0 ≤ v ≤ 13.1.3, 14.0.0 ≤ v ≤ 14.1.2, 15.0.0 ≤ v ≤ 15.1.0 | — |
| f5 big-ip_global_traffic_manager | 12.1.0 ≤ v ≤ 12.1.5, 13.0.0 ≤ v ≤ 13.1.3, 14.0.0 ≤ v ≤ 14.1.2, 15.0.0 ≤ v ≤ 15.1.0 | — |
| f5 big-ip_link_controller | 12.1.0 ≤ v ≤ 12.1.5, 13.0.0 ≤ v ≤ 13.1.3, 14.0.0 ≤ v ≤ 14.1.2, 15.0.0 ≤ v ≤ 15.1.0 | — |
| f5 big-ip_local_traffic_manager | 12.1.0 ≤ v ≤ 12.1.5, 13.0.0 ≤ v ≤ 13.1.3, 14.0.0 ≤ v ≤ 14.1.2, 15.0.0 ≤ v ≤ 15.1.0 | — |
| f5 big-ip_policy_enforcement_manager | 12.1.0 ≤ v ≤ 12.1.5, 13.0.0 ≤ v ≤ 13.1.3, 14.0.0 ≤ v ≤ 14.1.2, 15.0.0 ≤ v ≤ 15.1.0 | — |
| f5 big-ip_webaccelerator | 12.1.0 ≤ v ≤ 12.1.5, 13.0.0 ≤ v ≤ 13.1.3, 14.0.0 ≤ v ≤ 14.1.2, 15.0.0 ≤ v ≤ 15.1.0 | — |
| f5 big-iq_centralized_management | 6.0.0 ≤ v ≤ 6.1.0, 7.0.0 ≤ v ≤ 7.1.0 | — |
| f5 traffix_signaling_delivery_controller | 5.0.0 ≤ v ≤ 5.1.0, 4.4.0 | — |
| tenable nessus | v ≤ 8.2.3 | — |
| opensuse leap | 15.0, 15.1, 42.3 | — |
| netapp cn1610_firmware | No range specified | — |
| netapp a320_firmware | No range specified | — |
| netapp c190_firmware | No range specified | — |
| netapp a220_firmware | No range specified | — |
| netapp fas2720_firmware | No range specified | — |
| netapp fas2750_firmware | No range specified | — |
| netapp a800_firmware | No range specified | — |
| fedoraproject fedora | 29, 30, 31 | — |
| mcafee agent | 5.6.0 ≤ v ≤ 5.6.4 | — |
| mcafee data_exchange_layer | 4.0.0 ≤ v < 6.0.0 | 6.0.0 |
| mcafee threat_intelligence_exchange_server | 2.0.0 ≤ v < 3.0.0 | 3.0.0 |
| mcafee web_gateway | 7.0.0 ≤ v < 9.0.0 | 9.0.0 |
| redhat jboss_enterprise_web_server | 5.0.0 | — |
| redhat virtualization | 4.0 | — |
| redhat virtualization_host | 4.0 | — |
| redhat enterprise_linux_desktop | 6.0, 7.0 | — |
| redhat enterprise_linux_server | 6.0, 7.0 | — |
| redhat enterprise_linux_workstation | 6.0, 7.0 | — |
| oracle api_gateway | 11.1.2.4.0 | — |
| oracle business_intelligence | 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle communications_diameter_signaling_router | 8.0.0, 8.1, 8.2, 8.3, 8.4 | — |
| oracle communications_performance_intelligence_center | 10.4.0.2 | — |
| oracle communications_session_border_controller | 7.4, 8.0.0, 8.1.0, 8.2, 8.3 | — |
| oracle communications_session_router | 7.4, 8.0, 8.1, 8.2, 8.3 | — |
| oracle communications_unified_session_manager | 7.3.5, 8.2.5 | — |
| oracle endeca_server | 7.7.0 | — |
| oracle enterprise_manager_base_platform | 12.1.0.5.0, 13.2.0.0.0, 13.3.0.0.0 | — |
| oracle enterprise_manager_ops_center | 12.3.3, 12.4.0 | — |
| oracle jd_edwards_enterpriseone_tools | 9.2 | — |
| oracle jd_edwards_world_security | a9.3, a9.3.1, a9.4 | — |
| oracle mysql | 5.6.0 ≤ v ≤ 5.6.43, 5.7.0 ≤ v ≤ 5.7.25, 8.0.0 ≤ v ≤ 8.0.15 | — |
| oracle mysql_enterprise_monitor | v ≤ 4.0.8, 8.0.0 ≤ v ≤ 8.0.14 | — |
| oracle mysql_workbench | v ≤ 8.0.16 | — |
| oracle peoplesoft_enterprise_peopletools | 8.55, 8.56, 8.57 | — |
| oracle secure_global_desktop | 5.4 | — |
| oracle services_tools_bundle | 19.2 | — |
| paloaltonetworks pan-os | 7.1.0 ≤ v < 7.1.15, 8.0.0 ≤ v < 8.0.20, 8.1.0 ≤ v < 8.1.8, 9.0.0 ≤ v < 9.0.2 | 7.1.15, 8.0.20, 8.1.8, 9.0.2 |
| nodejs node.js | 6.0.0 ≤ v ≤ 6.8.1, 6.9.0 ≤ v < 6.17.0, 8.0.0 ≤ v ≤ 8.8.1, 8.9.0 ≤ v < 8.15.1 | 6.17.0, 8.15.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.