5
CVSSv2

CVE-2019-1551

Published: 06/12/2019 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 5.3 | Impact Score: 1.4 | Exploitability Score: 3.9
VMScore: 449
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Summary

There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

openssl openssl

opensuse leap 15.1

oracle peoplesoft enterprise peopletools 8.56

oracle peoplesoft enterprise peopletools 8.57

oracle peoplesoft enterprise peopletools 8.58

oracle mysql enterprise monitor

oracle enterprise manager ops center 12.4.0.0

canonical ubuntu linux 16.04

canonical ubuntu linux 18.04

canonical ubuntu linux 19.10

fedoraproject fedora 30

fedoraproject fedora 31

fedoraproject fedora 32

debian debian linux 9.0

debian debian linux 10.0

tenable log correlation engine

Vendor Advisories

Debian Bug report logs - #947949 openssl: CVE-2019-1551 Package: src:openssl; Maintainer for src:openssl is Debian OpenSSL Team <pkg-openssl-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 2 Jan 2020 15:54:01 UTC Severity: important Tags: fixed-upstream, security, ups ...
Several security issues were fixed in OpenSSL ...
Synopsis Low: openssl security, bug fix, and enhancement update Type/Severity Security Advisory: Low Topic An update for openssl is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVSS) bas ...
Synopsis Moderate: Red Hat JBoss Core Services Apache HTTP Server 2437 SP5 security update Type/Severity Security Advisory: Moderate Topic Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2437 and fix several bugs, and add various enhancements are now available for Red Hat En ...
Synopsis Moderate: Red Hat JBoss Core Services Apache HTTP Server 2437 SP5 security update Type/Severity Security Advisory: Moderate Topic Red Hat JBoss Core Services Pack Apache Server 2437 Service Pack 5 zip release for RHEL 6, RHEL 7, RHEL 8 and Microsoft Windows is availableRed Hat Product Security ...
Synopsis Moderate: Release of OpenShift Serverless 1110 Type/Severity Security Advisory: Moderate Topic Release of OpenShift Serverless 1110 Description Red Hat OpenShift Serverless 1110 is a generally available release of theOpenShift Serverless Operator This version of the OpenShif ...
Synopsis Moderate: OpenShift Container Platform 46 compliance-operator security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for compliance-content-container, ose-compliance-openscap-container, ose-compliance-operator-container, and ose-compliance-operator-metadata-container ...
Synopsis Moderate: OpenShift Container Platform 46 compliance-operator security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for compliance-content-container, ose-compliance-openscap-container, ose-compliance-operator-container, and ose-compliance-operator-metadata-container ...
Synopsis Moderate: Red Hat OpenShift Container Storage 460 security, bug fix, enhancement update Type/Severity Security Advisory: Moderate Topic Updated images are now available for Red Hat OpenShift Container Storage 460 on Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as ha ...
Guido Vranken discovered an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli For the oldstable distribution (stretch), this problem has been fixed in version 102u-1~deb9u1 We recommend that you upgrade your openssl10 packages For the detailed security status of openssl10 please refer to its ...
Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit An overflow bug in the x64_64 Montgomery squaring procedure, an integer overflow in CipherUpdate and a NULL pointer dereference flaw X509_issuer_and_serial_hash() were found, which could result in denial of service Additional details can be found in the upstr ...
An integer overflow was found in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli As per upstream:* No EC algorithms are affected * Attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely * Attacks against DH512 are ...
A vulnerability (CVE-2019-1551) exists in JP1 Affected products and versions are listed below Please upgrade your version to the appropriate version ...
A vulnerability (CVE-2019-1551) exists in Cosminexus HTTP Server Affected products and versions are listed below Please upgrade your version to the appropriate version ...
Multiple vulnerabilities have been found in Hitachi Command Suite, Hitachi Automation Director, Hitachi Configuration Manager, Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center CVE-2019-1547, CVE-2019-1549, CVE-2019-1551, CVE-2019-1563, CVE-2020-1971, CVE-2021-3711, CVE-2021-3712, CVE-2021-23840, CVE-2021-23841, CVE-2022-0778, CVE- ...
Tenablesc leverages third-party software to help provide underlying functionality Three separate third-party components (OpenSSL, Apache HTTP Server, SimpleSAMLphp) were found to contain vulnerabilities, and updated versions have been made available by the providers Out of caution and in line with good practice, Tenable opted to upgrade the bun ...
Nessus Agent leverages third-party software to help provide underlying functionality One of the third-party components (OpenSSL) was found to contain a multiple vulnerabilities, and updated versions have been made available by the providers Out of caution and in line with good practice, Tenable opted to upgrade the bundled library to address the ...
Tenablesc leverages third-party software to help provide underlying functionality Two separate third-party components (jQuery and OpenSSL) were found to contain vulnerabilities, and updated versions have been made available by the providers Out of caution and in line with good practice, Tenable opted to upgrade the bundled libraries to address ...
Tenable Log Correlation Engine leverages third-party software to help provide underlying functionality Two separate third-party components (OpenSSL, jQuery) were found to contain vulnerabilities, and updated versions have been made available by the providers Out of caution and in line with good practice, Tenable opted to upgrade the bundled Open ...

References

CWE-190https://www.openssl.org/news/secadv/20191206.txthttps://security.netapp.com/advisory/ntap-20191210-0001/https://seclists.org/bugtraq/2019/Dec/39http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.htmlhttps://www.debian.org/security/2019/dsa-4594https://seclists.org/bugtraq/2019/Dec/46https://www.tenable.com/security/tns-2019-09http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.htmlhttps://security.gentoo.org/glsa/202004-10https://www.tenable.com/security/tns-2020-03https://usn.ubuntu.com/4376-1/https://www.oracle.com/security-alerts/cpujul2020.htmlhttps://usn.ubuntu.com/4504-1/https://www.tenable.com/security/tns-2020-11https://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.debian.org/security/2021/dsa-4855https://www.tenable.com/security/tns-2021-10https://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://lists.debian.org/debian-lts-announce/2022/03/msg00023.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=419102400a2811582a7a3d4a4e317d72e5ce0a8fhttps://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f1c5eea8a817075d31e43f5876993c6710238c98https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947949https://nvd.nist.govhttps://usn.ubuntu.com/4376-1/