mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-07-29 05:56:59 +00:00
- Synchronized data.
This commit is contained in:
CVE Team
parent
21038b30d8
commit
c85aa02154
@ -1,82 +1,82 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "openssl-security@openssl.org",
|
||||
"DATE_PUBLIC": "2019-02-26",
|
||||
"ID": "CVE-2019-1559",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "0-byte record padding oracle"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "OpenSSL",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "OpenSSL"
|
||||
}
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "openssl-security@openssl.org",
|
||||
"DATE_PUBLIC" : "2019-02-26",
|
||||
"ID" : "CVE-2019-1559",
|
||||
"STATE" : "PUBLIC",
|
||||
"TITLE" : "0-byte record padding oracle"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "OpenSSL",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "OpenSSL"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "Juraj Somorovsky, Robert Merget and Nimrod Aviram, with additional investigation by Steven Collison and Andrew Hourselt"
|
||||
}
|
||||
],
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"url" : "https://www.openssl.org/policies/secpolicy.html#Moderate",
|
||||
"value" : "Moderate"
|
||||
}
|
||||
],
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "Padding Oracle"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Juraj Somorovsky, Robert Merget and Nimrod Aviram, with additional investigation by Steven Collison and Andrew Hourselt"
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"url": "https://www.openssl.org/policies/secpolicy.html#Moderate",
|
||||
"value": "Moderate"
|
||||
}
|
||||
],
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Padding Oracle"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://www.openssl.org/news/secadv/20190226.txt",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://www.openssl.org/news/secadv/20190226.txt"
|
||||
},
|
||||
{
|
||||
"name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e"
|
||||
},
|
||||
{
|
||||
"name" : "https://www.openssl.org/news/secadv/20190226.txt",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://www.openssl.org/news/secadv/20190226.txt"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@ -54,6 +54,8 @@
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://nvidia.custhelp.com/app/answers/detail/a_id/4772",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://nvidia.custhelp.com/app/answers/detail/a_id/4772"
|
||||
}
|
||||
]
|
||||
|
||||
@ -54,6 +54,8 @@
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://nvidia.custhelp.com/app/answers/detail/a_id/4772",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://nvidia.custhelp.com/app/answers/detail/a_id/4772"
|
||||
}
|
||||
]
|
||||
|
||||
@ -54,6 +54,8 @@
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://nvidia.custhelp.com/app/answers/detail/a_id/4772",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://nvidia.custhelp.com/app/answers/detail/a_id/4772"
|
||||
}
|
||||
]
|
||||
|
||||
@ -54,6 +54,8 @@
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://nvidia.custhelp.com/app/answers/detail/a_id/4772",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://nvidia.custhelp.com/app/answers/detail/a_id/4772"
|
||||
}
|
||||
]
|
||||
|
||||
@ -54,6 +54,8 @@
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://nvidia.custhelp.com/app/answers/detail/a_id/4772",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://nvidia.custhelp.com/app/answers/detail/a_id/4772"
|
||||
}
|
||||
]
|
||||
|
||||
@ -54,6 +54,8 @@
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://nvidia.custhelp.com/app/answers/detail/a_id/4772",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://nvidia.custhelp.com/app/answers/detail/a_id/4772"
|
||||
}
|
||||
]
|
||||
|
||||
@ -54,6 +54,8 @@
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://nvidia.custhelp.com/app/answers/detail/a_id/4772",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://nvidia.custhelp.com/app/answers/detail/a_id/4772"
|
||||
}
|
||||
]
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user