CVE-2019-1559

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive… (CVE-2019-1559)

Description

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

Source: CVELISTV5 NVD

Metrics

Severity

medium

87.63

—

no public PoC known

5.9

Source: nvd-v3

CVSS v3

5.9

CVSS v4

—

EPSS percentile

96.9 %

Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).

EPSS score

17.1 %

Elevated — model estimates 10-50% exploitation likelihood.

Published

2019-02-27 23:00 UTC

CWE

—

Affected operating systems

linux
debian / debian_linux8.0
linux
debian / debian_linux9.0
linux
redhat / enterprise_linux_desktop6.0
linux
redhat / enterprise_linux_desktop7.0
linux
redhat / enterprise_linux_server6.0
linux
redhat / enterprise_linux_server7.0
linux
redhat / enterprise_linux_workstation6.0
linux
redhat / enterprise_linux_workstation7.0
linux
opensuse / leap15.0
linux
opensuse / leap15.1
linux
opensuse / leap42.3
linux
canonical / ubuntu_linux16.04
linux
canonical / ubuntu_linux18.04
linux
canonical / ubuntu_linux18.10
other
netapp / a220_firmware
other
netapp / a320_firmware
other
netapp / a800_firmware
other
netapp / c190_firmware
other
netapp / cn1610_firmware
other
netapp / fas2720_firmware
other
netapp / fas2750_firmware
other
fedoraproject / fedora29
other
fedoraproject / fedora30
other
fedoraproject / fedora31

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

f5
big-ip_access_policy_manager12.1.0 – 12.1.5
f5
big-ip_access_policy_manager13.0.0 – 13.1.3
f5
big-ip_access_policy_manager14.0.0 – 14.1.2
f5
big-ip_access_policy_manager15.0.0 – 15.1.0
f5
big-ip_advanced_firewall_manager12.1.0 – 12.1.5
f5
big-ip_advanced_firewall_manager13.0.0 – 13.1.3
f5
big-ip_advanced_firewall_manager14.0.0 – 14.1.2
f5
big-ip_advanced_firewall_manager15.0.0 – 15.1.0
f5
big-ip_analytics12.1.0 – 12.1.5
f5
big-ip_analytics13.0.0 – 13.1.3
f5
big-ip_analytics14.0.0 – 14.1.2
f5
big-ip_analytics15.0.0 – 15.1.0
f5
big-ip_application_acceleration_manager12.1.0 – 12.1.5
f5
big-ip_application_acceleration_manager13.0.0 – 13.1.3
f5
big-ip_application_acceleration_manager14.0.0 – 14.1.2
f5
big-ip_application_acceleration_manager15.0.0 – 15.1.0
f5
big-ip_application_security_manager12.1.0 – 12.1.5
f5
big-ip_application_security_manager13.0.0 – 13.1.3
f5
big-ip_application_security_manager14.0.0 – 14.1.2
f5
big-ip_application_security_manager15.0.0 – 15.1.0
f5
big-ip_domain_name_system12.1.0 – 12.1.5
f5
big-ip_domain_name_system13.0.0 – 13.1.3
f5
big-ip_domain_name_system14.0.0 – 14.1.2
f5
big-ip_domain_name_system15.0.0 – 15.1.0

References & sources

IDCVE-2019-1559