Home

CVE-2019-1559

Description

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable non-stitched ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

Risk Information

Base Score
5.9
MODERATE
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
4.96

Associated Vulnerability

VulnerabilityOS Platform
Update OpenSSL to version 1.0.2rWindows
Update OpenSSL (x64) to version 1.0.2rWindows
Vulnerabilities CVE-2019-1559 are fixed in OpenSSL (x64) 1.0.2rWindows
Multiple vulnerabilities affected in Mysql 5.6.21Windows
Multiple vulnerabilities affected in Mysql 5.6.22Windows
Multiple vulnerabilities affected in Mysql 5.6.23Windows
Multiple vulnerabilities affected in Mysql 5.6.24Windows
Multiple vulnerabilities affected in Mysql 5.6.25Windows
Multiple vulnerabilities affected in Mysql 5.6.26Windows
Multiple vulnerabilities affected in Mysql 5.6.35Windows
Multiple vulnerabilities affected in Mysql 5.6.9Windows
Multiple Vulnerabilities are affected in Mysql 8.0.15Windows
Vulnerabilities CVE-2019-5737,CVE-2018-12122,CVE-2019-5739,CVE-2019-1559 are fixed in Node.js (11.15.0)Windows
Vulnerabilities CVE-2019-5737,CVE-2018-12122,CVE-2019-5739,CVE-2019-1559 are fixed in Node.js (x64)(11.15.0)Windows
Vulnerabilities CVE-2019-5737,CVE-2018-12122,CVE-2019-5739,CVE-2019-1559 are fixed in Node.js (x64) (10.15.2)Windows
Vulnerabilities CVE-2019-5737,CVE-2018-12122,CVE-2019-5739,CVE-2019-1559 are fixed in Node.js (10.15.2)Windows
Vulnerabilities CVE-2019-5737,CVE-2018-12122,CVE-2019-5739,CVE-2019-1559 are fixed in Node.js 10 (10.24.1)Windows
Vulnerabilities CVE-2019-5737,CVE-2018-12122,CVE-2019-5739,CVE-2019-1559 are fixed in Node.js 16 (x64) (16.17.0)Windows
Vulnerabilities CVE-2019-5737,CVE-2018-12122,CVE-2019-5739,CVE-2019-1559 are fixed in Node.js 16 (16.17.0)Windows
Vulnerabilities CVE-2019-5737,CVE-2018-12122,CVE-2019-5739,CVE-2019-1559 are fixed in Node.js 8 8.15.1Windows
Vulnerabilities CVE-2019-5737,CVE-2018-12122,CVE-2019-5739,CVE-2019-1559 are fixed in Node.js 8 (x64) 8.15.1Windows
Vulnerabilities CVE-2016-4055,CVE-2017-18214,CVE-2019-1559 are affected in Nessus Agent (x64) 8.2.3Windows
Vulnerabilities CVE-2016-4055,CVE-2017-18214,CVE-2019-1559 are affected in Nessus Agent 8.2.3Windows
Vulnerabilities CVE-2019-1559 are fixed in Nessus Agent 7.4.0Windows
Vulnerabilities CVE-2019-1559,CVE-2019-2614,CVE-2019-2627,CVE-2019-2683 are affected in Mysql 5.6.43Windows
Multiple vulnerabilities are affected in Mysql 5.7.25Windows
Vulnerabilities CVE-2019-1559 are affected in MySQL Workbench Enterprise Edition 8.0.16Windows
Vulnerabilities CVE-2019-1559 are affected in MySQL Workbench CE (x64) 8.0.16Windows
Vulnerabilities CVE-2019-1559,CVE-2017-18214,CVE-2016-4055 are fixed in Nessus Agent (x64) (8.3.0.20052)Windows
Vulnerabilities CVE-2019-1559,CVE-2017-18214,CVE-2016-4055 are fixed in Nessus Agent (8.3.0.20052)Windows
Vulnerabilities CVE-2019-1559,CVE-2017-18214,CVE-2016-4055 are fixed in Tenable Nessus 8.3.0Windows
Multiple Vulnerabilities are affected in Netapp Snapcenter -Windows
Multiple Vulnerabilities are affected in Netapp Oncommand Workflow Automation -Windows
Multiple Vulnerabilities are affected in Netapp Active Iq Unified Manager 2.3Windows
Multiple Vulnerabilities are affected in Netapp Oncommand Insight 2.3Windows
Multiple vulnerabilities are affected in Oracle PeopleSoft Enterprise PeopleTools 8.55Windows
Multiple vulnerabilities are affected in Oracle PeopleSoft Enterprise PeopleTools 8.56Windows
Multiple vulnerabilities are affected in Oracle PeopleSoft Enterprise PeopleTools 8.57Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.0Windows
Secure Socket Layer (SSL) cryptographic library and tools (USN-3899-1) libssl1.0.0_1.0.2n-1ubuntu5.3_i386.debLinux
Secure Socket Layer (SSL) cryptographic library and tools (USN-3899-1) libssl1.0.0_1.0.2n-1ubuntu5.3_amd64.debLinux
Secure Socket Layer (SSL) cryptographic library and tools (USN-3899-1) libssl1.0.0_1.0.2n-1ubuntu6.2_i386.debLinux
Secure Socket Layer (SSL) cryptographic library and tools (USN-3899-1) libssl1.0.0_1.0.2n-1ubuntu6.2_amd64.debLinux
Secure Socket Layer (SSL) cryptographic library and tools (USN-3899-1) libssl1.0.0_1.0.2g-1ubuntu4.15_i386.debLinux
Secure Socket Layer (SSL) cryptographic library and tools (USN-3899-1) libssl1.0.0_1.0.2g-1ubuntu4.15_amd64.debLinux
SUSE-SU-2019:0572-1(SUSE Linux Enterprise Desktop 12-SP4 ) libopenssl-1_0_0-devel-1.0.2p-3.6.1.x86_64.rpmLinux
SUSE-SU-2019:0572-1(SUSE Linux Enterprise Desktop 12-SP4 ) libopenssl1_0_0-1.0.2p-3.6.1.x86_64.rpmLinux
SUSE-SU-2019:0572-1(SUSE Linux Enterprise Desktop 12-SP4 ) libopenssl1_0_0-32bit-1.0.2p-3.6.1.x86_64.rpmLinux
SUSE-SU-2019:0572-1(SUSE Linux Enterprise Desktop 12-SP4 ) libopenssl1_0_0-debuginfo-1.0.2p-3.6.1.x86_64.rpmLinux
SUSE-SU-2019:0572-1(SUSE Linux Enterprise Desktop 12-SP4 ) libopenssl1_0_0-debuginfo-32bit-1.0.2p-3.6.1.x86_64.rpmLinux
SUSE-SU-2019:0572-1(SUSE Linux Enterprise Desktop 12-SP4 ) openssl-1_0_0-1.0.2p-3.6.1.x86_64.rpmLinux
SUSE-SU-2019:0572-1(SUSE Linux Enterprise Desktop 12-SP4 ) openssl-1_0_0-debuginfo-1.0.2p-3.6.1.x86_64.rpmLinux
SUSE-SU-2019:0572-1(SUSE Linux Enterprise Desktop 12-SP4 ) openssl-1_0_0-debugsource-1.0.2p-3.6.1.x86_64.rpmLinux
SUSE-SU-2019:0803-1(SUSE Linux Enterprise Desktop 12-SP3 ) libopenssl-devel-1.0.2j-60.49.1.x86_64.rpmLinux
SUSE-SU-2019:0803-1(SUSE Linux Enterprise Desktop 12-SP3 ) libopenssl1_0_0-1.0.2j-60.49.1.x86_64.rpmLinux
SUSE-SU-2019:0803-1(SUSE Linux Enterprise Desktop 12-SP3 ) libopenssl1_0_0-32bit-1.0.2j-60.49.1.x86_64.rpmLinux
SUSE-SU-2019:0803-1(SUSE Linux Enterprise Desktop 12-SP3 ) libopenssl1_0_0-debuginfo-1.0.2j-60.49.1.x86_64.rpmLinux
SUSE-SU-2019:0803-1(SUSE Linux Enterprise Desktop 12-SP3 ) libopenssl1_0_0-debuginfo-32bit-1.0.2j-60.49.1.x86_64.rpmLinux
SUSE-SU-2019:0803-1(SUSE Linux Enterprise Desktop 12-SP3 ) openssl-1.0.2j-60.49.1.x86_64.rpmLinux
SUSE-SU-2019:0803-1(SUSE Linux Enterprise Desktop 12-SP3 ) openssl-debuginfo-1.0.2j-60.49.1.x86_64.rpmLinux
SUSE-SU-2019:0803-1(SUSE Linux Enterprise Desktop 12-SP3 ) openssl-debugsource-1.0.2j-60.49.1.x86_64.rpmLinux
(RHSA-2019:2471) openssl security update openssl-1.0.1e-58.el6_10.i686.rpmLinux
(RHSA-2019:2471) openssl security update openssl-1.0.1e-58.el6_10.x86_64.rpmLinux
(RHSA-2019:2471) openssl security update openssl-devel-1.0.1e-58.el6_10.i686.rpmLinux
(RHSA-2019:2471) openssl security update openssl-devel-1.0.1e-58.el6_10.x86_64.rpmLinux
(RHSA-2019:2471) openssl security update openssl-perl-1.0.1e-58.el6_10.i686.rpmLinux
(RHSA-2019:2471) openssl security update openssl-perl-1.0.1e-58.el6_10.x86_64.rpmLinux
(RHSA-2019:2471) openssl security update openssl-static-1.0.1e-58.el6_10.i686.rpmLinux
(RHSA-2019:2471) openssl security update openssl-static-1.0.1e-58.el6_10.x86_64.rpmLinux
Openssl update (ELSA-2019-2471) openssl-1.0.1e-58.0.1.el6_10.x86_64.rpmLinux
Openssl-devel update (ELSA-2019-2471) openssl-devel-1.0.1e-58.0.1.el6_10.x86_64.rpmLinux
Openssl-perl update (ELSA-2019-2471) openssl-perl-1.0.1e-58.0.1.el6_10.x86_64.rpmLinux
Openssl-static update (ELSA-2019-2471) openssl-static-1.0.1e-58.0.1.el6_10.x86_64.rpmLinux
Openssl update (ELSA-2019-2471) openssl-1.0.1e-58.0.1.el6_10.i686.rpmLinux
Openssl-devel update (ELSA-2019-2471) openssl-devel-1.0.1e-58.0.1.el6_10.i686.rpmLinux
Openssl-perl update (ELSA-2019-2471) openssl-perl-1.0.1e-58.0.1.el6_10.i686.rpmLinux
Openssl-static update (ELSA-2019-2471) openssl-static-1.0.1e-58.0.1.el6_10.i686.rpmLinux
Multiple vulnerabilities affected in Mysql 5.6.21 (For Linux)Linux
Multiple vulnerabilities affected in Mysql 5.6.22 (For Linux)Linux
Multiple vulnerabilities affected in Mysql 5.6.23 (For Linux)Linux
Multiple vulnerabilities affected in Mysql 5.6.24 (For Linux)Linux
Multiple vulnerabilities affected in Mysql 5.6.25 (For Linux)Linux
Multiple vulnerabilities affected in Mysql 5.6.26 (For Linux)Linux
Multiple vulnerabilities affected in Mysql 5.6.35 (For Linux)Linux
Multiple vulnerabilities affected in Mysql 5.6.9 (For Linux)Linux
(CESA-2019:2471) openssl security update openssl-1.0.1e-58.el6_10.x86_64.rpmLinux
(CESA-2019:2471) openssl security update openssl-devel-1.0.1e-58.el6_10.x86_64.rpmLinux
(CESA-2019:2471) openssl security update openssl-perl-1.0.1e-58.el6_10.i686.rpmLinux
(CESA-2019:2471) openssl security update openssl-static-1.0.1e-58.el6_10.i686.rpmLinux
Observable Discrepancy Vulnerability (CVE-2019-1559)NCM

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-309917Node.js (11.15.0)
PATCH-309918Node.js (x64)(11.15.0)
PATCH-319043Node.js 10 (x64) (10.24.1)
PATCH-319042Node.js 10 (10.24.1)
PATCH-319042Node.js 10 (10.24.1)
PATCH-332182Node.js 16 (x64) (16.20.2)
PATCH-332181Node.js 16 (16.20.2)
PATCH-343100Nessus Agent (x64) (10.8.0)
PATCH-343099Nessus Agent (10.8.0)
PATCH-337447Nessus Agent (10.6.1)
PATCH-347137MySQL Workbench CE (x64) (8.0.42)
PATCH-346982Nessus Agent (x64) (10.8.4) (Manual Upload Required)
PATCH-346981Nessus Agent (10.8.4) (Manual Upload Required)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234