Impact: Low Public Date: 2019-09-10 CWE: CWE-200 Bugzilla: 1752095: CVE-2019-1549 openssl: information disclosure in fork() OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).
The MITRE CVE dictionary describes this issue as:
Find out more about CVE-2019-1549 from the MITRE CVE dictionary dictionary and NIST NVD.
NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.
| CVSS3 Base Score | 3.7 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| Attack Vector | Network |
| Attack Complexity | High |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | Low |
| Integrity Impact | None |
| Availability Impact | None |
| Platform | Package | State |
|---|---|---|
| Red Hat JBoss Web Server 5 | openssl | Under investigation |
| Red Hat JBoss Web Server 3 | openssl | Under investigation |
| Red Hat JBoss EWS 2 | openssl | Under investigation |
| Red Hat JBoss EAP 6 | openssl | Under investigation |
| Red Hat JBoss EAP 5 | openssl | Under investigation |
| Red Hat JBoss Core Services 1 | openssl | Under investigation |
| Red Hat Enterprise Linux 8 | openssl | Under investigation |
| Red Hat Enterprise Linux 8 | mingw-openssl | Under investigation |
| Red Hat Enterprise Linux 7 | openssl | Under investigation |
| Red Hat Enterprise Linux 6 | openssl | Under investigation |
| Red Hat Enterprise Linux 5 | openssl | Under investigation |
Vulmon