Vulnerability Details : CVE-2019-1547
Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
Products affected by CVE-2019-1547
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-1547
0.16%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 34 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-1547
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
1.9
|
LOW | AV:L/AC:M/Au:N/C:P/I:N/A:N |
3.4
|
2.9
|
NIST | |
4.7
|
MEDIUM | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
1.0
|
3.6
|
NIST |
References for CVE-2019-1547
-
https://www.debian.org/security/2019/dsa-4540
Debian -- Security Information -- DSA-4540-1 openssl1.0
-
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html
[security-announce] openSUSE-SU-2019:2158-1: moderate: Security update f
-
https://www.oracle.com/security-alerts/cpujan2020.html
Oracle Critical Patch Update Advisory - January 2020
-
https://www.oracle.com/security-alerts/cpuoct2020.html
Oracle Critical Patch Update Advisory - October 2020
-
https://support.f5.com/csp/article/K73422160?utm_source=f5support&%3Butm_medium=RSS
OpenSSL vulnerability CVE-2019-1547
-
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=30c22fa8b1d840036b8e203585738df62a03cec8
git.openssl.org Git - openssl.git/commitdiffMailing List;Patch;Vendor Advisory
-
https://www.tenable.com/security/tns-2019-09
[R1] Tenable.sc 5.13.0 Fixes Multiple Third-Party Vulnerabilities - Security Advisory | Tenable®
-
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=21c856b75d81eff61aa63b4f036bb64a85bf6d46
git.openssl.org Git
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/
[SECURITY] Fedora 29 Update: openssl-1.1.1d-1.fc29 - package-announce - Fedora Mailing-Lists
-
https://www.oracle.com/security-alerts/cpuapr2020.html
Oracle Critical Patch Update Advisory - April 2020
-
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=7c1709c2da5414f5b6133d00a03fc8c5bf996c7a
git.openssl.org Git
-
https://seclists.org/bugtraq/2019/Oct/0
Bugtraq: [SECURITY] [DSA 4540-1] openssl1.0 security update
-
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Page not found | Oracle
-
https://www.oracle.com/security-alerts/cpujul2020.html
Oracle Critical Patch Update Advisory - July 2020
-
https://usn.ubuntu.com/4376-1/
USN-4376-1: OpenSSL vulnerabilities | Ubuntu security notices
-
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html
[security-announce] openSUSE-SU-2019:2189-1: moderate: Security update f
-
https://www.tenable.com/security/tns-2019-08
[R1] Nessus Network Monitor 5.11.0 Fixes Multiple Third-party Vulnerabilities - Security Advisory | Tenable®
-
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=7c1709c2da5414f5b6133d00a03fc8c5bf996c7a
git.openssl.org Git - openssl.git/commitdiffMailing List;Patch;Vendor Advisory
-
https://security.gentoo.org/glsa/201911-04
OpenSSL: Multiple vulnerabilities (GLSA 201911-04) — Gentoo security
-
http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html
Slackware Security Advisory - openssl Updates ≈ Packet Storm
-
https://www.debian.org/security/2019/dsa-4539
Debian -- Security Information -- DSA-4539-1 openssl
-
https://usn.ubuntu.com/4504-1/
USN-4504-1: OpenSSL vulnerabilities | Ubuntu security notices | Ubuntu
-
https://support.f5.com/csp/article/K73422160?utm_source=f5support&utm_medium=RSS
-
https://arxiv.org/abs/1909.01785
[1909.01785] Certified Side ChannelsThird Party Advisory
-
https://seclists.org/bugtraq/2019/Oct/1
Bugtraq: [SECURITY] [DSA 4539-1] openssl security update
-
https://security.netapp.com/advisory/ntap-20240621-0006/
February 2024 IBM Cognos Analytics Vulnerabilities in NetApp Products | NetApp Product Security
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/
[SECURITY] Fedora 30 Update: openssl-1.1.1d-1.fc30 - package-announce - Fedora Mailing-Lists
-
https://seclists.org/bugtraq/2019/Sep/25
Bugtraq: [slackware-security] openssl (SSA:2019-254-03)Third Party Advisory
-
https://www.openssl.org/news/secadv/20190910.txt
Vendor Advisory
-
https://security.netapp.com/advisory/ntap-20200122-0002/
January 2020 MySQL Vulnerabilities in NetApp Products | NetApp Product Security
-
https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html
[SECURITY] [DLA 1932-1] openssl security update
-
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html
[security-announce] openSUSE-SU-2019:2268-1: moderate: Security update f
-
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=21c856b75d81eff61aa63b4f036bb64a85bf6d46
git.openssl.org Git - openssl.git/commitdiffMailing List;Patch;Vendor Advisory
-
https://security.netapp.com/advisory/ntap-20190919-0002/
September 2019 OpenSSL Vulnerabilities in NetApp Products | NetApp Product Security
-
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html
[security-announce] openSUSE-SU-2019:2269-1: moderate: Security update f
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/
[SECURITY] Fedora 30 Update: openssl-1.1.1d-1.fc30 - package-announce - Fedora Mailing-Lists
-
https://security.netapp.com/advisory/ntap-20200416-0003/
April 2020 MySQL Vulnerabilities in NetApp Products | NetApp Product Security
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/
[SECURITY] Fedora 29 Update: openssl-1.1.1d-1.fc29 - package-announce - Fedora Mailing-Lists
-
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=30c22fa8b1d840036b8e203585738df62a03cec8
git.openssl.org Git
-
https://kc.mcafee.com/corporate/index?page=content&id=SB10365
Security Bulletin - Policy Auditor update fixes multiple vulnerabilities in third-party libraries (CVE-2016-0718, CVE-2016-4472, CVE-2016-5300, CVE-2017-17740, CVE-2017-9287, CVE-2019-13057, CVE-2020-
-
https://usn.ubuntu.com/4376-2/
USN-4376-2: OpenSSL vulnerabilities | Ubuntu security notices | Ubuntu
Jump to