OpenSSL CVE-2019-1559 Information Disclosure Vulnerability

Bugtraq ID:	107174
Class:	Design Error
CVE:	CVE-2019-1559
Remote:	Yes
Local:	No
Published:	Feb 26 2019 12:00AM
Updated:	Jul 17 2019 06:00AM
Credit:	Juraj Somorovsky, Robert Merget and Nimrod Aviram, with additional investigation by Steven Collison and Andrew Hourselt
Vulnerable:	Oracle Solaris 11.4 Oracle Solaris 11.3 Oracle Solaris 10 Oracle Services Tools Bundle 19.2 Oracle Secure Global Desktop 5.4 Oracle PeopleSoft Enterprise PeopleTools 8.57 Oracle PeopleSoft Enterprise PeopleTools 8.56 Oracle PeopleSoft Enterprise PeopleTools 8.55 Oracle MySQL Workbench 8.0.16 Oracle MySQL Workbench 8.0.13 Oracle MySQL Workbench 8.0.11 Oracle MySQL Workbench 6.3.10 Oracle MySQL Workbench 6.3.8 Oracle MySQL Workbench 6.1.5 Oracle MySQL Workbench 6.1.4 Oracle MySQL Server 8.0.15 Oracle MySQL Server 8.0.14 Oracle MySQL Server 8.0.13 Oracle MySQL Server 8.0.12 Oracle MySQL Server 8.0.11 Oracle MySQL Server 5.7.25 Oracle MySQL Server 5.7.24 Oracle MySQL Server 5.7.23 Oracle MySQL Server 5.7.22 Oracle MySQL Server 5.7.21 Oracle MySQL Server 5.7.20 Oracle MySQL Server 5.7.19 Oracle MySQL Server 5.7.18 Oracle MySQL Server 5.7.17 Oracle MySQL Server 5.7.16 Oracle MySQL Server 5.7.15 Oracle MySQL Server 5.7.12 Oracle MySQL Server 5.7 Oracle MySQL Server 5.6.43 Oracle MySQL Server 5.6.42 Oracle MySQL Server 5.6.41 Oracle MySQL Server 5.6.40 Oracle MySQL Server 5.6.39 Oracle MySQL Server 5.6.38 Oracle MySQL Server 5.6.37 Oracle MySQL Server 5.6.36 Oracle MySQL Server 5.6.35 Oracle MySQL Server 5.6.34 Oracle MySQL Server 5.6.33 Oracle MySQL Server 5.6.30 Oracle MySQL Server 5.6.29 Oracle MySQL Server 5.6.28 Oracle MySQL Server 5.6.27 Oracle MySQL Server 5.6.26 Oracle MySQL Server 5.6.23 Oracle MySQL Server 5.6.22 Oracle MySQL Server 5.6.21 Oracle MySQL Server 5.6.25 Oracle MySQL Server 5.6.24 Oracle MySQL Server 5.6.20 Oracle MySQL Server 5.6.16 Oracle MySQL Server 5.6.15 Oracle MySQL Connectors 8.0.15 Oracle MySQL Connectors 8.0.13 Oracle MySQL Connectors 8.0.12 Oracle MySQL Connectors 8.0.11 Oracle MySQL Connectors 5.3.12 Oracle MySQL Connectors 5.3.10 Oracle MySQL Connectors 5.3.9 Oracle MySQL Connectors 5.3.7 Oracle JD Edwards World Security A9.4 Oracle JD Edwards World Security A9.3.1 Oracle JD Edwards World Security A9.3 Oracle JD Edwards EnterpriseOne Tools 9.2 Oracle Enterprise Manager Ops Center 12.4 Oracle Enterprise Manager Ops Center 12.3.3 Oracle Enterprise Manager Base Platform 13.3.0.0.0 Oracle Enterprise Manager Base Platform 13.2.0.0.0 Oracle Enterprise Manager Base Platform 12.1.0.5.0 Oracle Endeca Server 7.7.0 OpenSSL Project OpenSSL 1.0.2 OpenSSL Project OpenSSL 1.0.2q OpenSSL Project OpenSSL 1.0.2p OpenSSL Project OpenSSL 1.0.2o OpenSSL Project OpenSSL 1.0.2n OpenSSL Project OpenSSL 1.0.2m OpenSSL Project OpenSSL 1.0.2l OpenSSL Project OpenSSL 1.0.2k OpenSSL Project OpenSSL 1.0.2j OpenSSL Project OpenSSL 1.0.2i OpenSSL Project OpenSSL 1.0.2h OpenSSL Project OpenSSL 1.0.2g OpenSSL Project OpenSSL 1.0.2f OpenSSL Project OpenSSL 1.0.2e OpenSSL Project OpenSSL 1.0.2d OpenSSL Project OpenSSL 1.0.2c OpenSSL Project OpenSSL 1.0.2b OpenSSL Project OpenSSL 1.0.2a IBM Vios 2.2 IBM Aix 7.2 IBM AIX 7.1
Not Vulnerable:	OpenSSL Project OpenSSL 1.0.2r

OpenSSL CVE-2019-1559 Information Disclosure Vulnerability

OpenSSL is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks.

OpenSSL 1.0.2 through 1.0.2q are vulnerable.

OpenSSL CVE-2019-1559 Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

OpenSSL CVE-2019-1559 Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

OpenSSL CVE-2019-1559 Information Disclosure Vulnerability

References:

• OpenSSL Homepage (OpenSSL)
  
• TLS Padding Oracles (Ruhr University Bochum)
  
• 0-byte record padding oracle (CVE-2019-1559) (OpeSSL)
  
• Oracle Critical Patch Update Advisory - April 2019 (Oracle)
  
• Oracle Critical Patch Update Advisory - July 2019 (Oracle)
  
• Oracle Solaris Third Party Bulletin - April 2019 (Oracle)
  
• SA44019 - February 26 2019 OpenSSL Security Advisory (Pulse Secure)
  
• Security Bulletin: Vulnerability in OpenSSL affects AIX (CVE-2019-1559) (IBM)