5.9

CVE-2019-1559: canonical ubuntu_linux Observable Discrepancy

CVSS: 5.9v3.1MediumModified
AliasesALPINE-CVE-2019-1559MGASA-2019-0106SUSE-SU-2019:0572-1
Published 27-02-2019Last modified 17-09-2024
Open JSON

Vulnerability summary

CVE-2019-1559 is a medium (CVSS 5.9) Observable Discrepancy vulnerability in canonical ubuntu_linux. EPSS estimates a 17.14% chance of exploitation in the next 30 days, higher than 97% of scored vulnerabilities.

Overall risk
27/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.9/10
010
Medium · v3.1 (NVD)
EPSS score
17.14%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 9 · Related 7
OPENSUSE-SU-2024:11126-1RHSA-2019:2304RHSA-2019:2437RHSA-2019:2439RHSA-2019:3929SUSE-SU-2019:0658-1

Timeline

  1. 27-02-2019
    PublishedVulnerability first disclosed.
  2. 17-09-2024
    Last modifiedVulnerability information updated.

Description

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

CVSS metrics

8 scores · 6 sources · 3 versions

EPSS trend

Probability

17.14%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

0.00 pp

From 17.14% on 19-09-2026

19-09-202619-10-2026
EPSS score
17.14%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Netapp31 products
Suse26 products
  • compat-openssl098&distro=SUSE Linux Enterprise Desktop 12 SP3< 0.9.8j-106.12.1
  • compat-openssl098&distro=SUSE Linux Enterprise Desktop 12 SP4< 0.9.8j-106.12.1
  • compat-openssl098&distro=SUSE Linux Enterprise Module for Legacy 12< 0.9.8j-106.12.1
  • compat-openssl098&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP1< 0.9.8j-106.12.1
  • compat-openssl098&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2< 0.9.8j-106.12.1
Oracle18 products
F515 products
Redhat11 products
Chainguard6 products
  • mysql-8.0< 8.0.38-r0
  • mysql-8.0-client< 8.0.38-r0
  • mysql-8.0-dev< 8.0.38-r0
  • mysql-8.0-iamguarded-compat< 8.0.38-r0
  • mysql-8.0-oci-entrypoint< 8.0.38-r0
Mcafee4 products
Debian3 products
  • openssl< 1.1.0b-2 | < 1.0.1t-1+deb8u11
  • openssl1.0< 1.0.2r-1~deb9u1
  • debian_linuxEOL8.0 | 9.0
Opensuse3 products
  • leapEOL15.0 | 15.1 | 42.3
  • openssl-1_0_0&distro=openSUSE Leap 15.0< 1.0.2p-lp150.2.13.1
  • openssl-1_0_0&distro=openSUSE Leap 15.1< 1.0.2p-lp151.5.3.1
Ubuntu2 products
  • openssl< 1.0.1f-1ubuntu2.27+esm1 | < 1.0.2g-1ubuntu4.15
  • openssl1.0< 1.0.2n-1ubuntu5.3
Alpine1 product
  • openssl≥ 1.0.2, < 1.0.2r-r0
Canonical1 product
Fedoraproject1 product
Mageia1 product
  • openssl< 1.0.2r-1.mga6
Nodejs1 product
  • node.js≥ 6.0.0, ≤ 6.8.1 | ≥ 6.9.0, < 6.17.0 | ≥ 8.0.0, ≤ 8.8.1 | ≥ 8.9.0, < 8.15.1
Openssl1 product
  • opensslFixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q) | ≥ 1.0.2, < 1.0.2r
Paloaltonetworks1 product
  • pan-os≥ 7.1.0, < 7.1.15 | ≥ 8.0.0, < 8.0.20 | ≥ 8.1.0, < 8.1.8 | ≥ 9.0.0, < 9.0.2
Tenable1 product

18 vendors · 127 products

References

65 links
Show all 65 references