Bug 1683804 (CVE-2019-1559)
| Summary: | CVE-2019-1559 openssl: 0-byte record padding oracle | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Laura Pardo <lpardo> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | apmukher, bmcclain, cfeng, dawwu, dblechte, dchong, dereed, dfediuck, eedri, hkario, lersek, mgoldboi, michal.skrivanek, nbhumkar, philmd, rdlugyhe, sbonazzo, sherold, szidek, tmraz, tsorense, yozone, ysoni, yturgema |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | openssl 1.0.2r | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-08-06 19:20:46 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1683805, 1683806, 1683807, 1683808, 1683962, 1683963, 1684986, 1684987, 1709065, 1712021, 1718148, 1803226, 1803227, 1803228 | ||
| Bug Blocks: | 1683809 | ||
|
Description
Laura Pardo
2019-02-27 21:01:45 UTC
Created compat-openssl10 tracking bugs for this issue: Affects: fedora-all [bug 1683808] Created mingw-openssl tracking bugs for this issue: Affects: epel-7 [bug 1683806] Affects: fedora-all [bug 1683805] Created openssl tracking bugs for this issue: Affects: fedora-all [bug 1683807] This is essentially a padding oracle flaw, which needs the following conditions for exploitation: 1. Non-stitched cipher suites are used. (https://software.intel.com/en-us/articles/improving-openssl-performance talks about stitching cipher suites) 2. AES-NI is not used. 3. Applications must call SSL_shutdown() twice even if a protocol error has occurred 4. The attacker must be able to run a script in the victim's browser which sends requests to a vulnerable website. This can be achieved tempting the victim to visit a malicious website. Second, the attacker must be able to modify requests sent by the browser and observe the server behavior. The second prerequisite is much harder to achieve, because the attacker must be an active Man-in-the-Middle. External References: https://www.openssl.org/news/secadv/20190226.txt https://github.com/RUB-NDS/TLS-Padding-Oracles This vulnerability is out of security support scope for the following product: * Red Hat JBoss Web Server 3 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details. This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2304 https://access.redhat.com/errata/RHSA-2019:2304 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-1559 This issue has been addressed in the following products: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 Via RHSA-2019:2437 https://access.redhat.com/errata/RHSA-2019:2437 This issue has been addressed in the following products: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 Via RHSA-2019:2439 https://access.redhat.com/errata/RHSA-2019:2439 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2019:2471 https://access.redhat.com/errata/RHSA-2019:2471 This issue has been addressed in the following products: Red Hat JBoss Web Server Via RHSA-2019:3931 https://access.redhat.com/errata/RHSA-2019:3931 This issue has been addressed in the following products: Red Hat JBoss Web Server 5.2 on RHEL 7 Red Hat JBoss Web Server 5.2 on RHEL 6 Red Hat JBoss Web Server 5.2 on RHEL 8 Via RHSA-2019:3929 https://access.redhat.com/errata/RHSA-2019:3929 Statement:
1 For this issue to be exploitable, the (server) application using the OpenSSL library needs to use it incorrectly.
2. There are multiple other requirements for the attack to succeed:
- The ciphersuite used must be obsolete CBC cipher without a stitched implementation (or the system be in FIPS mode)
- the attacker has to be a MITM
- the attacker has to be able to control the client side to send requests to the buggy server on demand
Mitigation: As a workaround you can disable SHA384 if applications (compiled with OpenSSL) allow for adjustment of the ciphersuite string configuration. |