If an application encounters a fatal protocol error and then calls SSLshutdown() twice (once to send a closenotify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).
{
"versions": [
{
"introduced": "0"
},
{
"last_affected": "7.3.5"
},
{
"introduced": "0"
},
{
"last_affected": "a9.3.1"
},
{
"introduced": "8.0.0"
},
{
"last_affected": "8.0.15"
},
{
"introduced": "0"
},
{
"last_affected": "4.0.8"
},
{
"introduced": "8.0.0"
},
{
"last_affected": "8.0.14"
},
{
"introduced": "0"
},
{
"last_affected": "8.0.16"
},
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.20"
}
]
}{
"versions": [
{
"introduced": "0"
},
{
"last_affected": "18.10"
},
{
"introduced": "0"
},
{
"last_affected": "8.0"
},
{
"introduced": "0"
},
{
"last_affected": "9.0"
},
{
"introduced": "15.0.0"
},
{
"last_affected": "15.1.0"
},
{
"introduced": "15.0.0"
},
{
"last_affected": "15.1.0"
},
{
"introduced": "15.0.0"
},
{
"last_affected": "15.1.0"
},
{
"introduced": "15.0.0"
},
{
"last_affected": "15.1.0"
},
{
"introduced": "15.0.0"
},
{
"last_affected": "15.1.0"
},
{
"introduced": "15.0.0"
},
{
"last_affected": "15.1.0"
},
{
"introduced": "15.0.0"
},
{
"last_affected": "15.1.0"
},
{
"introduced": "15.0.0"
},
{
"last_affected": "15.1.0"
},
{
"introduced": "15.0.0"
},
{
"last_affected": "15.1.0"
},
{
"introduced": "15.0.0"
},
{
"last_affected": "15.1.0"
},
{
"introduced": "15.0.0"
},
{
"last_affected": "15.1.0"
},
{
"introduced": "15.0.0"
},
{
"last_affected": "15.1.0"
},
{
"introduced": "15.0.0"
},
{
"last_affected": "15.1.0"
},
{
"introduced": "6.0.0"
},
{
"last_affected": "6.1.0"
},
{
"introduced": "7.0.0"
},
{
"last_affected": "7.1.0"
},
{
"introduced": "5.0.0"
},
{
"last_affected": "5.1.0"
},
{
"introduced": "0"
},
{
"last_affected": "4.4.0"
},
{
"introduced": "0"
},
{
"last_affected": "15.0"
},
{
"introduced": "0"
},
{
"last_affected": "15.1"
},
{
"introduced": "4.0.0"
},
{
"fixed": "6.0.0"
},
{
"introduced": "2.0.0"
},
{
"fixed": "3.0.0"
},
{
"introduced": "7.0.0"
},
{
"fixed": "9.0.0"
},
{
"introduced": "0"
},
{
"last_affected": "5.0.0"
},
{
"introduced": "0"
},
{
"last_affected": "6.0"
},
{
"introduced": "0"
},
{
"last_affected": "7.0"
},
{
"introduced": "0"
},
{
"last_affected": "6.0"
},
{
"introduced": "0"
},
{
"last_affected": "7.0"
},
{
"introduced": "0"
},
{
"last_affected": "6.0"
},
{
"introduced": "0"
},
{
"last_affected": "7.0"
},
{
"introduced": "0"
},
{
"last_affected": "8.0.0"
},
{
"introduced": "0"
},
{
"last_affected": "8.1"
},
{
"introduced": "0"
},
{
"last_affected": "8.2"
},
{
"introduced": "0"
},
{
"last_affected": "8.3"
},
{
"introduced": "0"
},
{
"last_affected": "8.4"
},
{
"introduced": "0"
},
{
"last_affected": "7.4"
},
{
"introduced": "0"
},
{
"last_affected": "8.0.0"
},
{
"introduced": "0"
},
{
"last_affected": "8.1.0"
},
{
"introduced": "0"
},
{
"last_affected": "8.2"
},
{
"introduced": "0"
},
{
"last_affected": "8.3"
},
{
"introduced": "0"
},
{
"last_affected": "7.4"
},
{
"introduced": "0"
},
{
"last_affected": "8.0"
},
{
"introduced": "0"
},
{
"last_affected": "8.1"
},
{
"introduced": "0"
},
{
"last_affected": "8.2"
},
{
"introduced": "0"
},
{
"last_affected": "8.3"
},
{
"introduced": "0"
},
{
"last_affected": "7.7.0"
},
{
"introduced": "0"
},
{
"last_affected": "12.4.0"
},
{
"introduced": "0"
},
{
"last_affected": "9.2"
},
{
"introduced": "0"
},
{
"last_affected": "a9.3"
},
{
"introduced": "0"
},
{
"last_affected": "a9.4"
},
{
"introduced": "0"
},
{
"last_affected": "5.4"
},
{
"introduced": "0"
},
{
"last_affected": "19.2"
},
{
"introduced": "6.0.0"
},
{
"last_affected": "6.8.1"
},
{
"introduced": "6.9.0"
},
{
"fixed": "6.17.0"
},
{
"introduced": "8.0.0"
},
{
"last_affected": "8.8.1"
},
{
"introduced": "8.9.0"
},
{
"fixed": "8.15.1"
}
]
}{
"versions": [
{
"introduced": "1.0.2"
},
{
"fixed": "1.0.2r"
},
{
"introduced": "0"
},
{
"last_affected": "4.0"
},
{
"introduced": "0"
},
{
"last_affected": "4.0"
}
]
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-1559.json"
[
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "16.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "18.04"
}
]
},
{
"events": [
{
"introduced": "7.3"
}
]
},
{
"events": [
{
"introduced": "9.5"
}
]
},
{
"events": [
{
"introduced": "9.0.0"
},
{
"last_affected": "9.0.4"
}
]
},
{
"events": [
{
"introduced": "12.1.0"
},
{
"last_affected": "12.1.5"
}
]
},
{
"events": [
{
"introduced": "13.0.0"
},
{
"last_affected": "13.1.3"
}
]
},
{
"events": [
{
"introduced": "14.0.0"
},
{
"last_affected": "14.1.2"
}
]
},
{
"events": [
{
"introduced": "12.1.0"
},
{
"last_affected": "12.1.5"
}
]
},
{
"events": [
{
"introduced": "13.0.0"
},
{
"last_affected": "13.1.3"
}
]
},
{
"events": [
{
"introduced": "14.0.0"
},
{
"last_affected": "14.1.2"
}
]
},
{
"events": [
{
"introduced": "12.1.0"
},
{
"last_affected": "12.1.5"
}
]
},
{
"events": [
{
"introduced": "13.0.0"
},
{
"last_affected": "13.1.3"
}
]
},
{
"events": [
{
"introduced": "14.0.0"
},
{
"last_affected": "14.1.2"
}
]
},
{
"events": [
{
"introduced": "12.1.0"
},
{
"last_affected": "12.1.5"
}
]
},
{
"events": [
{
"introduced": "13.0.0"
},
{
"last_affected": "13.1.3"
}
]
},
{
"events": [
{
"introduced": "14.0.0"
},
{
"last_affected": "14.1.2"
}
]
},
{
"events": [
{
"introduced": "12.1.0"
},
{
"last_affected": "12.1.5"
}
]
},
{
"events": [
{
"introduced": "13.0.0"
},
{
"last_affected": "13.1.3"
}
]
},
{
"events": [
{
"introduced": "14.0.0"
},
{
"last_affected": "14.1.2"
}
]
},
{
"events": [
{
"introduced": "12.1.0"
},
{
"last_affected": "12.1.5"
}
]
},
{
"events": [
{
"introduced": "13.0.0"
},
{
"last_affected": "13.1.3"
}
]
},
{
"events": [
{
"introduced": "14.0.0"
},
{
"last_affected": "14.1.2"
}
]
},
{
"events": [
{
"introduced": "12.1.0"
},
{
"last_affected": "12.1.5"
}
]
},
{
"events": [
{
"introduced": "13.0.0"
},
{
"last_affected": "13.1.3"
}
]
},
{
"events": [
{
"introduced": "14.0.0"
},
{
"last_affected": "14.1.2"
}
]
},
{
"events": [
{
"introduced": "12.1.0"
},
{
"last_affected": "12.1.5"
}
]
},
{
"events": [
{
"introduced": "13.0.0"
},
{
"last_affected": "13.1.3"
}
]
},
{
"events": [
{
"introduced": "14.0.0"
},
{
"last_affected": "14.1.2"
}
]
},
{
"events": [
{
"introduced": "12.1.0"
},
{
"last_affected": "12.1.5"
}
]
},
{
"events": [
{
"introduced": "13.0.0"
},
{
"last_affected": "13.1.3"
}
]
},
{
"events": [
{
"introduced": "14.0.0"
},
{
"last_affected": "14.1.2"
}
]
},
{
"events": [
{
"introduced": "12.1.0"
},
{
"last_affected": "12.1.5"
}
]
},
{
"events": [
{
"introduced": "13.0.0"
},
{
"last_affected": "13.1.3"
}
]
},
{
"events": [
{
"introduced": "14.0.0"
},
{
"last_affected": "14.1.2"
}
]
},
{
"events": [
{
"introduced": "12.1.0"
},
{
"last_affected": "12.1.5"
}
]
},
{
"events": [
{
"introduced": "13.0.0"
},
{
"last_affected": "13.1.3"
}
]
},
{
"events": [
{
"introduced": "14.0.0"
},
{
"last_affected": "14.1.2"
}
]
},
{
"events": [
{
"introduced": "12.1.0"
},
{
"last_affected": "12.1.5"
}
]
},
{
"events": [
{
"introduced": "13.0.0"
},
{
"last_affected": "13.1.3"
}
]
},
{
"events": [
{
"introduced": "14.0.0"
},
{
"last_affected": "14.1.2"
}
]
},
{
"events": [
{
"introduced": "12.1.0"
},
{
"last_affected": "12.1.5"
}
]
},
{
"events": [
{
"introduced": "13.0.0"
},
{
"last_affected": "13.1.3"
}
]
},
{
"events": [
{
"introduced": "14.0.0"
},
{
"last_affected": "14.1.2"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.2.3"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "42.3"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "29"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "30"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "31"
}
]
},
{
"events": [
{
"introduced": "5.6.0"
},
{
"last_affected": "5.6.4"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "11.1.2.4.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "11.1.1.9.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "12.2.1.3.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "12.2.1.4.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "10.4.0.2"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.2.5"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "12.1.0.5.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "13.2.0.0.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "13.3.0.0.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "12.3.3"
}
]
},
{
"events": [
{
"introduced": "5.6.0"
},
{
"last_affected": "5.6.43"
}
]
},
{
"events": [
{
"introduced": "5.7.0"
},
{
"last_affected": "5.7.25"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.55"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.56"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.57"
}
]
},
{
"events": [
{
"introduced": "7.1.0"
},
{
"fixed": "7.1.15"
}
]
},
{
"events": [
{
"introduced": "8.1.0"
},
{
"fixed": "8.1.8"
}
]
},
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.2"
}
]
}
]
[
{
"signature_version": "v1",
"target": {
"file": "sql/auth/sql_security_ctx.cc"
},
"source": "https://github.com/mysql/mysql-server/commit/7d10c82196c8e45554f27c00681474a9fb86d137",
"deprecated": false,
"digest": {
"line_hashes": [
"317463022452382766021103977305274585179",
"231023415934437405040826552604315029303",
"297740067960712497696382412249502119229",
"309425770541891912532229026717192392036",
"284148148647439509389511598979234415422",
"116378823324225689461236126012161469315",
"86824927962339967726030080493727111830",
"229418578243886234607155219959991524149",
"248333722744294557902251110539727458724",
"60562948043869069039720139670193814094",
"234065302816130076253002738647915957633",
"284004652744631390210136567077888520262",
"160922535157528631778173976280695262599",
"31363143091404555847052523631550609500",
"309255939664318821618380824832978289908",
"50551599195409746706267459404639193933",
"170240436352108084277830328958887278124",
"279197034075409124961633015511866447613",
"332791052601321667762795215187482398841"
],
"threshold": 0.9
},
"id": "CVE-2019-1559-627d45fc",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "crypto/opensslv.h"
},
"source": "https://github.com/openssl/openssl/commit/e818b74be2170fbe957a07b0da4401c2b694b3b8",
"deprecated": false,
"digest": {
"line_hashes": [
"251633914150035957322733061977107206211",
"338514574181828579838011565939158652696",
"76638288692106140328510055542557597351",
"142922657400765574308962710386922248045",
"71649992455794854055653842592139575350",
"65527166711110472566013424527579064967",
"253196866009476977787139000804413898733",
"172177136897997206866313011107384691461"
],
"threshold": 0.9
},
"id": "CVE-2019-1559-e051451f",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "sql/auth/sql_security_ctx.cc",
"function": "Security_context::checkout_access_maps"
},
"source": "https://github.com/mysql/mysql-server/commit/7d10c82196c8e45554f27c00681474a9fb86d137",
"deprecated": false,
"digest": {
"function_hash": "66171467169832509301814870837451245409",
"length": 1080.0
},
"id": "CVE-2019-1559-e648c373",
"signature_type": "Function"
}
]