CVE-2019-1551

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).

References

https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f

https://www.openssl.org/news/secadv/20191206.txt

https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98

https://security.netapp.com/advisory/ntap-20191210-0001/

https://seclists.org/bugtraq/2019/Dec/39

http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html

https://www.debian.org/security/2019/dsa-4594

https://seclists.org/bugtraq/2019/Dec/46

https://www.tenable.com/security/tns-2019-09

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html

https://security.gentoo.org/glsa/202004-10

https://lists.fedoraproject.org/archives/list/[email protected]/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/

https://www.tenable.com/security/tns-2020-03

https://lists.fedoraproject.org/archives/list/[email protected]/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/

https://lists.fedoraproject.org/archives/list/[email protected]/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/

https://usn.ubuntu.com/4376-1/

https://www.oracle.com/security-alerts/cpujul2020.html

https://usn.ubuntu.com/4504-1/

https://www.tenable.com/security/tns-2020-11

https://www.oracle.com/security-alerts/cpujan2021.html

https://www.debian.org/security/2021/dsa-4855

https://www.tenable.com/security/tns-2021-10

https://www.oracle.com/security-alerts/cpuApr2021.html

Details

Source: MITRE

Published: 2019-12-06

Updated: 2021-07-21

Type: CWE-200

Risk Information

CVSS v2

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

CVSS v3

Base Score: 5.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Impact Score: 1.4

Exploitability Score: 3.9

Severity: MEDIUM

Tenable Plugins

View all (45 total)

IDNameProductFamilySeverity
151794Amazon Linux 2 : openssl (ALAS-2021-1687)NessusAmazon Linux Local Security Checks
medium
150139Tenable Log Correlation Engine (LCE) < 6.0.9 (TNS-2021-10)NessusMisc.
medium
149201EulerOS 2.0 SP3 : openssl (EulerOS-SA-2021-1825)NessusHuawei Local Security Checks
medium
147241NewStart CGSL MAIN 6.02 : openssl Multiple Vulnerabilities (NS-SA-2021-0086)NessusNewStart CGSL Local Security Checks
medium
146599Debian DSA-4855-1 : openssl - security updateNessusDebian Local Security Checks
medium
145854CentOS 8 : openssl (CESA-2020:4514)NessusCentOS Local Security Checks
medium
144584Tenable SecurityCenter < 5.17.0 Multiple Vulnerabilities (TNS-2020-11)NessusMisc.
high
143076RHEL 8 : openssl (RHSA-2020:4514)NessusRed Hat Local Security Checks
medium
142750Oracle Linux 8 : openssl (ELSA-2020-4514)NessusOracle Linux Local Security Checks
medium
142025RHEL 6 / 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP5 (RHSA-2020:4384)NessusRed Hat Local Security Checks
critical
140645Ubuntu 16.04 LTS / 18.04 LTS : OpenSSL vulnerabilities (USN-4504-1)NessusUbuntu Local Security Checks
medium
138909Juniper Junos OpenSSL Security Advisory (JSA11025)NessusJunos Local Security Checks
medium
138594Oracle Enterprise Manager Ops Center (Jul 2020 CPU)NessusMisc.
medium
138568MySQL Enterprise Monitor 4.0.x < 4.0.13.5349 / 8.0.x < 8.0.21.1240 (Jul 2020 CPU)NessusCGI abuses
medium
138560MySQL 8.0.x < 8.0.21 Multiple Vulnerabilities (Jul 2020 CPU)NessusDatabases
high
137757Tenable Nessus Agent < 7.6.3 Third Party Vulnerability (OpenSSL) (TNS-2020-03)NessusMisc.
medium
137471EulerOS 2.0 SP2 : openssl110f (EulerOS-SA-2020-1629)NessusHuawei Local Security Checks
medium
137467EulerOS 2.0 SP2 : openssl (EulerOS-SA-2020-1625)NessusHuawei Local Security Checks
medium
136967Ubuntu 16.04 LTS / 18.04 LTS / 19.10 : OpenSSL vulnerabilities (USN-4376-1)NessusUbuntu Local Security Checks
medium
136439Fedora 31 : 1:openssl (2020-d7b29838f6)NessusFedora Local Security Checks
medium
136241EulerOS Virtualization for ARM 64 3.0.2.0 : openssl (EulerOS-SA-2020-1538)NessusHuawei Local Security Checks
medium
136155Fedora 30 : 1:openssl (2020-da2d1ef2d7)NessusFedora Local Security Checks
medium
135946GLSA-202004-10 : OpenSSL: Multiple vulnerabilitiesNessusGentoo Local Security Checks
medium
135606EulerOS Virtualization 3.0.2.2 : openssl (EulerOS-SA-2020-1444)NessusHuawei Local Security Checks
medium
135120EulerOS Virtualization for ARM 64 3.0.6.0 : compat-openssl10 (EulerOS-SA-2020-1333)NessusHuawei Local Security Checks
medium
134083SUSE SLES12 Security Update : openssl (SUSE-SU-2020:0474-1)NessusSuSE Local Security Checks
medium
133499Photon OS 2.0: Nxtgn PHSA-2020-2.0-0204NessusPhotonOS Local Security Checks
medium
133498Photon OS 3.0: Nxtgn PHSA-2020-3.0-0054NessusPhotonOS Local Security Checks
medium
133060Photon OS 3.0: Openssl PHSA-2020-3.0-0048NessusPhotonOS Local Security Checks
medium
132983Photon OS 1.0: Openssl PHSA-2020-1.0-0264NessusPhotonOS Local Security Checks
medium
132951openSUSE Security Update : openssl-1_1 (openSUSE-2020-62)NessusSuSE Local Security Checks
medium
132950openSUSE Security Update : openssl-1_0_0 (openSUSE-2020-61)NessusSuSE Local Security Checks
medium
132926SUSE SLED12 / SLES12 Security Update : openssl-1_1 (SUSE-SU-2020:0099-1)NessusSuSE Local Security Checks
medium
132853SUSE SLED15 / SLES15 Security Update : openssl-1_1 (SUSE-SU-2020:0069-1)NessusSuSE Local Security Checks
medium
132851SUSE SLED15 / SLES15 Security Update : openssl-1_0_0 (SUSE-SU-2020:0064-1)NessusSuSE Local Security Checks
medium
132817EulerOS Virtualization for ARM 64 3.0.5.0 : openssl (EulerOS-SA-2020-1063)NessusHuawei Local Security Checks
medium
132726OpenSSL 1.0.2 < 1.0.2u Procedure Overflow VulnerabilityNessusWeb Servers
medium
132725OpenSSL 1.1.1 < 1.1.1e-dev Procedure Overflow VulnerabilityNessusWeb Servers
medium
132707SUSE SLED12 / SLES12 Security Update : openssl-1_0_0 (SUSE-SU-2020:0028-1)NessusSuSE Local Security Checks
medium
132671SUSE SLED15 / SLES15 Security Update : openssl-1_1 (SUSE-SU-2020:0002-1)NessusSuSE Local Security Checks
medium
132614EulerOS 2.0 SP8 : openssl (EulerOS-SA-2020-1021)NessusHuawei Local Security Checks
medium
132425Debian DSA-4594-1 : openssl1.0 - security updateNessusDebian Local Security Checks
medium
132383Slackware 14.2 / current : openssl (SSA:2019-354-01)NessusSlackware Local Security Checks
medium
132366EulerOS 2.0 SP5 : openssl (EulerOS-SA-2019-2699)NessusHuawei Local Security Checks
medium
132351FreeBSD : OpenSSL -- Overflow vulnerability (d778ddb0-2338-11ea-a1c7-b499baebfeaf)NessusFreeBSD Local Security Checks
medium