CVE-2019-1549

OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "1.1.1"
                        },
                        {
                            "last_affected": "1.1.1c"
                        }
                    ],
                    "source": "CPE_RANGE"
                }
            ],
            "vendor_product": "openssl:openssl"
        }
    ]
}

References

Affected packages

Git / github.com/kzalewski/openssl-1.1.1

Affected ranges

Type

GIT

Repo

https://github.com/kzalewski/openssl-1.1.1

Events

Introduced

ddb327ab19b29c64c1752cef26c460ca0b7064ec

Last Affected

ddb327ab19b29c64c1752cef26c460ca0b7064ec

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.1.1"
                },
                {
                    "last_affected": "1.1.1c"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

1.*

1.1.1zh

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-1549.json"

Git / github.com/openssl/openssl

Affected ranges

Type

GIT

Repo

https://github.com/openssl/openssl

Events

Introduced

e04bd3433fd84e1861bf258ea37928d9845e6a86

Last Affected

e04bd3433fd84e1861bf258ea37928d9845e6a86

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.1.1"
                },
                {
                    "last_affected": "1.1.1c"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

Other

OpenSSL_1_1_1w

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-1549.json"