What is the CVSS score of CVE-2019-1559?

CVE-2019-1559 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 17.1%.

Is there a patch available for CVE-2019-1559?

Yes, a patch is available for CVE-2019-1559. Update the affected software to the latest version immediately.

Node.js CVE-2019-1559

MEDIUM

Observable Discrepancy (CWE-203)

2019-02-27 openssl-security@openssl.org

Information Disclosure Node.js OpenSSL MySQL Debian Oracle Red Hat Canonical Active Iq Unified Manager Agent Big Ip Application Security Manager Business Intelligence Debian Linux Enterprise Linux Desktop Enterprise Linux Server Enterprise Linux Workstation Fedora Hci Management Node Jd Edwards Enterpriseone Tools Leap Nessus Oncommand Insight Oncommand Workflow Automation Pan Os Peoplesoft Enterprise Peopletools Solidfire Ubuntu Linux Big Ip Access Policy Manager Big Ip Advanced Firewall Manager Big Ip Analytics Big Ip Application Acceleration Manager Big Ip Domain Name System Big Ip Edge Gateway Big Ip Fraud Protection Service Big Ip Global Traffic Manager Big Ip Link Controller Big Ip Local Traffic Manager Big Ip Policy Enforcement Manager Big Ip Webaccelerator Node Js Hci Compute Node Element Software Ontap Select Deploy Administration Utility Storagegrid Snapcenter Enterprise Manager Ops Center Clustered Data Ontap Antivirus Connector Santricity Smi S Provider Mysql Enterprise Monitor Mysql Workbench Communications Session Border Controller Communications Unified Session Manager Jd Edwards World Security Traffix Signaling Delivery Controller Steelstore Cloud Integrated Storage Cloud Backup Oncommand Unified Manager Secure Global Desktop Opensuse Virtualization Big Iq Centralized Management Snapprotect Jboss Enterprise Web Server Communications Diameter Signaling Router Web Gateway Service Processor Enterprise Manager Base Platform Api Gateway Data Exchange Layer Smi S Provider Snapdrive Virtualization Host A800 Firmware C190 Firmware A220 Firmware Fas2720 Firmware Fas2750 Firmware Storage Automation Store Oncommand Unified Manager Core Package A320 Firmware Altavault Cn1610 Firmware Ontap Select Deploy Communications Session Router Communications Performance Intelligence Center Hyper Converged Infrastructure Threat Intelligence Exchange Server Services Tools Bundle Endeca Server Netapp Paloaltonetworks F5 Tenable Fedoraproject Mcafee

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Feb 27, 2019 - 23:29 nvd

MEDIUM 5.9

DescriptionNVD

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-203. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q). Affected products include: Openssl, Canonical Ubuntu Linux, Debian Debian Linux, Netapp Active Iq Unified Manager, Netapp Altavault.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.