1. CVE-Search
  2. CVE-2019-1547
ID CVE-2019-1547
Summary Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
References
Vulnerable Configurations
  • cpe:2.3:a:openssl:openssl:1.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.1:-:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.1:-:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.1:pre1:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.1:pre1:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.1:pre2:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.1:pre2:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.1:pre3:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.1:pre3:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.1:pre4:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.1:pre4:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.1:pre5:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.1:pre5:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.1:pre6:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.1:pre6:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.1:pre7:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.1:pre7:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.1:pre8:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.1:pre8:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.1:pre9:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.1:pre9:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.1a:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.1a:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.1b:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.1b:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.1c:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.1c:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2:-:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2:-:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2i:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2i:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2j:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2j:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2l:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2l:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2m:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2m:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2n:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2n:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2o:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2o:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2p:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2p:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2q:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2q:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2r:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2r:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2s:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2s:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0:-:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0:-:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0:pre1:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0:pre1:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0:pre2:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0:pre2:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0:pre3:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0:pre3:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0:pre4:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0:pre4:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0:pre5:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0:pre5:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0:pre6:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0:pre6:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0a:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0a:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0b:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0b:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0c:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0c:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0d:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0d:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0e:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0e:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0f:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0f:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0g:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0g:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0h:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0h:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0i:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0i:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0j:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0j:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.1.0k:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.1.0k:*:*:*:*:*:*:*
CVSS
Base: 1.9 (as of 21-06-2024 - 19:15)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
LOCAL MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:L/AC:M/Au:N/C:P/I:N/A:N
redhat via4
rpms
  • jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6
  • jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7
  • jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el6
  • jbcs-httpd24-apr-debuginfo-0:1.6.3-86.jbcs.el7
  • jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el6
  • jbcs-httpd24-apr-devel-0:1.6.3-86.jbcs.el7
  • jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6
  • jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7
  • jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el6
  • jbcs-httpd24-brotli-debuginfo-0:1.0.6-21.jbcs.el7
  • jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el6
  • jbcs-httpd24-brotli-devel-0:1.0.6-21.jbcs.el7
  • jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6
  • jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7
  • jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el6
  • jbcs-httpd24-httpd-debuginfo-0:2.4.37-52.jbcs.el7
  • jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el6
  • jbcs-httpd24-httpd-devel-0:2.4.37-52.jbcs.el7
  • jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el6
  • jbcs-httpd24-httpd-manual-0:2.4.37-52.jbcs.el7
  • jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el6
  • jbcs-httpd24-httpd-selinux-0:2.4.37-52.jbcs.el7
  • jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el6
  • jbcs-httpd24-httpd-tools-0:2.4.37-52.jbcs.el7
  • jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6
  • jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7
  • jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el6
  • jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-41.Final_redhat_2.jbcs.el7
  • jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6
  • jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7
  • jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el6
  • jbcs-httpd24-mod_http2-debuginfo-0:1.11.3-22.jbcs.el7
  • jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el6
  • jbcs-httpd24-mod_ldap-0:2.4.37-52.jbcs.el7
  • jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el6
  • jbcs-httpd24-mod_proxy_html-1:2.4.37-52.jbcs.el7
  • jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el6
  • jbcs-httpd24-mod_session-0:2.4.37-52.jbcs.el7
  • jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el6
  • jbcs-httpd24-mod_ssl-1:2.4.37-52.jbcs.el7
  • jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6
  • jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7
  • jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el6
  • jbcs-httpd24-openssl-debuginfo-1:1.1.1c-16.jbcs.el7
  • jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el6
  • jbcs-httpd24-openssl-devel-1:1.1.1c-16.jbcs.el7
  • jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el6
  • jbcs-httpd24-openssl-libs-1:1.1.1c-16.jbcs.el7
  • jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el6
  • jbcs-httpd24-openssl-perl-1:1.1.1c-16.jbcs.el7
  • jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el6
  • jbcs-httpd24-openssl-static-1:1.1.1c-16.jbcs.el7
  • openssl-1:1.1.1c-15.el8
  • openssl-debuginfo-1:1.1.1c-15.el8
  • openssl-debugsource-1:1.1.1c-15.el8
  • openssl-devel-1:1.1.1c-15.el8
  • openssl-libs-1:1.1.1c-15.el8
  • openssl-libs-debuginfo-1:1.1.1c-15.el8
  • openssl-perl-1:1.1.1c-15.el8
refmap via4
bugtraq
  • 20190912 [slackware-security] openssl (SSA:2019-254-03)
  • 20191001 [SECURITY] [DSA 4539-1] openssl security update
  • 20191001 [SECURITY] [DSA 4540-1] openssl1.0 security update
confirm
debian
  • DSA-4539
  • DSA-4540
fedora
  • FEDORA-2019-d15aac6c4e
  • FEDORA-2019-d51641f152
gentoo GLSA-201911-04
misc
mlist [debian-lts-announce] 20190925 [SECURITY] [DLA 1932-1] openssl security update
suse
  • openSUSE-SU-2019:2158
  • openSUSE-SU-2019:2189
  • openSUSE-SU-2019:2268
  • openSUSE-SU-2019:2269
ubuntu
  • USN-4376-1
  • USN-4376-2
  • USN-4504-1
Last major update 21-06-2024 - 19:15
Published 10-09-2019 - 17:15
Last modified 21-06-2024 - 19:15
Back to Top