Vulnerability Details : CVE-2019-1549

OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).
Publish Date : 2019-09-10 Last Update Date : 2020-10-20

Collapse All Expand All Select Select&Copy	Scroll To Vendor Statements(0) Additional Vendor Data(0) OVAL Definitions(0) Vulnerable Products(0) # Of Vulns By Products References(0) Metasploit Modules(0)	Comments View User Comments Add Comment	External Links Secunia Advisories XForce Advisories Vulnerability Details at NVD Vulnerability Details at Mitre Nessus Plugins Linux Kernel Git Repository First CVSS Guide
Search Twitter Search YouTube Search Google

- CVSS Scores & Vulnerability Types

CVSS Score	5.0
Confidentiality Impact	Partial (There is considerable informational disclosure.)
Integrity Impact	None (There is no impact to the integrity of the system)
Availability Impact	None (There is no impact to the availability of the system.)
Access Complexity	Low (Specialized access conditions or extenuating circumstances do not exist. Very little knowledge or skill is required to exploit. )
Authentication	Not required (Authentication is not required to exploit the vulnerability.)
Gained Access	None
Vulnerability Type(s)
CWE ID	330

- Related OVAL Definitions

Title	Definition Id	Class	Family
RHSA-2020:1840: openssl security and bug fix update (Moderate)	oval:com.redhat.rhsa:def:20201840		unix

OVAL (Open Vulnerability and Assessment Language) definitions define exactly what should be done to verify a vulnerability or a missing patch. Check out the OVAL definitions if you want to learn what you should do to verify a vulnerability.

- Products Affected By CVE-2019-1549

#	Product Type	Vendor	Product	Version	Update	Edition	Language
1	Application	Openssl	Openssl	*	*	*	*	Version Details Vulnerabilities

- Number Of Affected Versions By Product

Vendor	Product	Vulnerable Versions
Openssl	Openssl	1

- References For CVE-2019-1549

https://www.oracle.com/security-alerts/cpuapr2020.html
N/A N/A

https://usn.ubuntu.com/4376-1/
UBUNTU USN-4376-1

https://www.oracle.com/security-alerts/cpujul2020.html

https://www.oracle.com/security-alerts/cpujan2020.html

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

https://support.f5.com/csp/article/K44070243?utm_source=f5support&utm_medium=RSS CONFIRM

https://www.debian.org/security/2019/dsa-4539
DEBIAN DSA-4539

https://seclists.org/bugtraq/2019/Oct/1
BUGTRAQ 20191001 [SECURITY] [DSA 4539-1] openssl security update

https://lists.fedoraproject.org/archives/list/[email protected]/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/
FEDORA FEDORA-2019-d51641f152

https://lists.fedoraproject.org/archives/list/[email protected]/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/
FEDORA FEDORA-2019-d15aac6c4e

https://support.f5.com/csp/article/K44070243 CONFIRM

https://security.netapp.com/advisory/ntap-20190919-0002/ CONFIRM

https://www.openssl.org/news/secadv/20190910.txt CONFIRM

https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be CONFIRM

https://www.oracle.com/security-alerts/cpuoct2020.html

- Metasploit Modules Related To CVE-2019-1549

There are not any metasploit modules related to this CVE entry (Please visit www.metasploit.com for more information)