CVE-2019-1559 OpenSSL
| Affected software | OpenSSL |
|---|---|
| Severity | 5.9 Medium CVSS 3.1 2 scores |
| Weakness | CWE-203 |
| Published | 27 Feb 2019 |
| Updated | 17 Jun 2026 |
Description
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 7 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment no assessment published
- Indexed PoC none indexed
- EPSS 17% chance in 30 days A model's forecast, not a report of exploitation. Higher than 97% of all scored CVEs.
Waratek protection
A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.
- Protection none
- Action not pursued none
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product. |
CVSS
5.9 MEDIUM
v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
CVSS
5.9 MEDIUM v3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
NVD | Primary | published |
| CVSS 2.0 | 4.3 | none | AV:N/AC:M/Au:N/C:P/I:N/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update January 2021 ↗ | CPU | 2021-Q1 | Oracle Communications / Security (OpenSSL) (10.4.0.2) |
| Oracle Critical Patch Update January 2020 ↗ | CPU | 2020-Q1 | Oracle Communications Applications / Platform (OpenSSL) (8.0, 8.1, 8.2, 8.3, 8.4) Oracle Communications Applications / Routing (OpenSSL) (7.3.5, 8.2.5) Oracle Communications Applications / Security (OpenSSL) (7.4, 8.0, 8.1, 8.2, 8.3) Oracle Communications Applications / Security (OpenSSL) (7.4, 8.0, 8.1, 8.2, 8.3) Oracle Fusion Middleware / Analytics Server and Analytics Web General (OpenSSL) (11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0) |
| Oracle Critical Patch Update October 2019 ↗ | CPU | 2019-Q4 | Oracle Fusion Middleware / Oracle API Gateway (OpenSSL) (11.1.2.4.0) Oracle Fusion Middleware / Secure Store (OpenSSL) (12.2.1.3.0, 12.2.1.4.0) |
| Oracle Critical Patch Update July 2019 ↗ | CPU | 2019-Q3 | Oracle Enterprise Manager Products Suite / Discovery Framework (OpenSSL) (12.1.0.5.0, 13.2.0.0.0, 13.3.0.0.0) Oracle Enterprise Manager Products Suite / Networking (OpenSSL) (12.3.3, 12.4.0) Oracle Fusion Middleware / Product Code (OpenSSL) (7.7.0) Oracle JD Edwards Products / Enterprise Infrastructure SEC (OpenSSL) (9.2) Oracle JD Edwards Products / Security Vulnerability (OpenSSL) (A9.3, A9.3.1, A9.4) Oracle MySQL / MySQL Workbench (OpenSSL) (8.0.16 and prior) Oracle PeopleSoft Products / Security (OpenSSL) (8.55, 8.56, 8.57) Oracle Support Tools / Utilities (OpenSSL) (19.2) |
| Oracle Critical Patch Update April 2019 ↗ | CPU | 2019-Q2 | Oracle MySQL / Connector/ODBC (OpenSSL) (5.3.12 and prior, 8.0.15 and prior) Oracle MySQL / Monitoring: General (OpenSSL) (4.0.8 and prior, 8.0.14 and prior) Oracle's note: MySQL Enterprise Monitor is not vulnerable to this CVE because it does not use the SSL/TLS functionality included in OpenSSL. The CVSS v3.0 Base Score for this CVE in the National Vulnerability Database (NVD) is 5.9. Oracle MySQL / Server: Compiling (OpenSSL) (5.6.43 and prior, 5.7.25 and prior, 8.0.15 and prior) Oracle Virtualization / Core (OpenSSL) (5.4) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications | Security (OpenSSL) | 10.4.0.2 | 10.4.0.2 |
| Oracle Communications Applications | Platform (OpenSSL) | 8.0, 8.1, 8.2, 8.3, 8.4 | 8.0 · 8.1 · 8.2 · 8.3 · 8.4 |
| Oracle Communications Applications | Routing (OpenSSL) | 7.3.5, 8.2.5 | 7.3.5 · 8.2.5 |
| Oracle Communications Applications | Security (OpenSSL) | 7.4, 8.0, 8.1, 8.2, 8.3 | 7.4 · 8.0 · 8.1 · 8.2 · 8.3 |
| Oracle Enterprise Manager Products Suite | Discovery Framework (OpenSSL) | 12.1.0.5.0, 13.2.0.0.0, 13.3.0.0.0 | 12.1.0.5.0 · 13.2.0.0.0 · 13.3.0.0.0 |
| Oracle Enterprise Manager Products Suite | Networking (OpenSSL) | 12.3.3, 12.4.0 | 12.3.3 · 12.4.0 |
| Oracle Fusion Middleware | Analytics Server and Analytics Web General (OpenSSL) | 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 | 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Fusion Middleware | Oracle API Gateway (OpenSSL) | 11.1.2.4.0 | 11.1.2.4.0 |
| Oracle Fusion Middleware | Product Code (OpenSSL) | 7.7.0 | 7.7.0 |
| Oracle Fusion Middleware | Secure Store (OpenSSL) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle JD Edwards Products | Enterprise Infrastructure SEC (OpenSSL) | 9.2 | 9.2 |
| Oracle JD Edwards Products | Security Vulnerability (OpenSSL) | A9.3, A9.3.1, A9.4 | |
| Oracle MySQL | Connector/ODBC (OpenSSL) | 5.3.12 and prior, 8.0.15 and prior | |
| Oracle MySQL | Monitoring: General (OpenSSL) | 4.0.8 and prior, 8.0.14 and prior | |
| Oracle MySQL | MySQL Workbench (OpenSSL) | 8.0.16 and prior | |
| Oracle MySQL | Server: Compiling (OpenSSL) | 5.6.43 and prior, 5.7.25 and prior, 8.0.15 and prior | |
| Oracle PeopleSoft Products | Security (OpenSSL) | 8.55, 8.56, 8.57 | 8.55 · 8.56 · 8.57 |
| Oracle Support Tools | Utilities (OpenSSL) | 19.2 | 19.2 |
| Oracle Virtualization | Core (OpenSSL) | 5.4 | 5.4 |
Products and versions
82 products, 167 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | canonical | ubuntu linux | generic | 16.04 · 18.04 · 18.10 |
| nvd | debian | debian linux | generic | 8.0 · 9.0 |
| nvd | f5 | big-ip access policy manager | generic | ≥ 12.1.0 and ≤ 12.1.5 · ≥ 13.0.0 and ≤ 13.1.3 · ≥ 14.0.0 and ≤ 14.1.2 · ≥ 15.0.0 and ≤ 15.1.0 |
| nvd | f5 | big-ip advanced firewall manager | generic | ≥ 12.1.0 and ≤ 12.1.5 · ≥ 13.0.0 and ≤ 13.1.3 · ≥ 14.0.0 and ≤ 14.1.2 · ≥ 15.0.0 and ≤ 15.1.0 |
| nvd | f5 | big-ip analytics | generic | ≥ 12.1.0 and ≤ 12.1.5 · ≥ 13.0.0 and ≤ 13.1.3 · ≥ 14.0.0 and ≤ 14.1.2 · ≥ 15.0.0 and ≤ 15.1.0 |
| nvd | f5 | big-ip application acceleration manager | generic | ≥ 12.1.0 and ≤ 12.1.5 · ≥ 13.0.0 and ≤ 13.1.3 · ≥ 14.0.0 and ≤ 14.1.2 · ≥ 15.0.0 and ≤ 15.1.0 |
| nvd | f5 | big-ip application security manager | generic | ≥ 12.1.0 and ≤ 12.1.5 · ≥ 13.0.0 and ≤ 13.1.3 · ≥ 14.0.0 and ≤ 14.1.2 · ≥ 15.0.0 and ≤ 15.1.0 |
| nvd | f5 | big-ip domain name system | generic | ≥ 12.1.0 and ≤ 12.1.5 · ≥ 13.0.0 and ≤ 13.1.3 · ≥ 14.0.0 and ≤ 14.1.2 · ≥ 15.0.0 and ≤ 15.1.0 |
| nvd | f5 | big-ip edge gateway | generic | ≥ 12.1.0 and ≤ 12.1.5 · ≥ 13.0.0 and ≤ 13.1.3 · ≥ 14.0.0 and ≤ 14.1.2 · ≥ 15.0.0 and ≤ 15.1.0 |
| nvd | f5 | big-ip fraud protection service | generic | ≥ 12.1.0 and ≤ 12.1.5 · ≥ 13.0.0 and ≤ 13.1.3 · ≥ 14.0.0 and ≤ 14.1.2 · ≥ 15.0.0 and ≤ 15.1.0 |
| nvd | f5 | big-ip global traffic manager | generic | ≥ 12.1.0 and ≤ 12.1.5 · ≥ 13.0.0 and ≤ 13.1.3 · ≥ 14.0.0 and ≤ 14.1.2 · ≥ 15.0.0 and ≤ 15.1.0 |
| nvd | f5 | big-ip link controller | generic | ≥ 12.1.0 and ≤ 12.1.5 · ≥ 13.0.0 and ≤ 13.1.3 · ≥ 14.0.0 and ≤ 14.1.2 · ≥ 15.0.0 and ≤ 15.1.0 |
| nvd | f5 | big-ip local traffic manager | generic | ≥ 12.1.0 and ≤ 12.1.5 · ≥ 13.0.0 and ≤ 13.1.3 · ≥ 14.0.0 and ≤ 14.1.2 · ≥ 15.0.0 and ≤ 15.1.0 |
| nvd | f5 | big-ip policy enforcement manager | generic | ≥ 12.1.0 and ≤ 12.1.5 · ≥ 13.0.0 and ≤ 13.1.3 · ≥ 14.0.0 and ≤ 14.1.2 · ≥ 15.0.0 and ≤ 15.1.0 |
| nvd | f5 | big-ip webaccelerator | generic | ≥ 12.1.0 and ≤ 12.1.5 · ≥ 13.0.0 and ≤ 13.1.3 · ≥ 14.0.0 and ≤ 14.1.2 · ≥ 15.0.0 and ≤ 15.1.0 |
| nvd | f5 | big-iq centralized management | generic | ≥ 6.0.0 and ≤ 6.1.0 · ≥ 7.0.0 and ≤ 7.1.0 |
| nvd | f5 | traffix signaling delivery controller | generic | 4.4.0 · ≥ 5.0.0 and ≤ 5.1.0 |
| nvd | fedoraproject | fedora | generic | 29 · 30 · 31 |
| nvd | mcafee | agent | generic | ≥ 5.6.0 and ≤ 5.6.4 |
| nvd | mcafee | data exchange layer | generic | ≥ 4.0.0 and ＜ 6.0.0 |
| nvd | mcafee | threat intelligence exchange server | generic | ≥ 2.0.0 and ＜ 3.0.0 |
| nvd | mcafee | web gateway | generic | ≥ 7.0.0 and ＜ 9.0.0 |
| nvd | netapp | a220 firmware | generic | any version |
| nvd | netapp | a320 firmware | generic | any version |
| nvd | netapp | a800 firmware | generic | any version |
| nvd | netapp | active iq unified manager | generic | any version · ≥ 7.3 · ≥ 9.5 |
| nvd | netapp | altavault | generic | any version |
| nvd | netapp | c190 firmware | generic | any version |
| nvd | netapp | cloud backup | generic | any version |
| nvd | netapp | clustered data ontap antivirus connector | generic | any version |
| nvd | netapp | cn1610 firmware | generic | any version |
| nvd | netapp | element software | generic | any version |
| nvd | netapp | fas2720 firmware | generic | any version |
| nvd | netapp | fas2750 firmware | generic | any version |
| nvd | netapp | hci compute node | generic | any version |
| nvd | netapp | hci management node | generic | any version |
| nvd | netapp | hyper converged infrastructure | generic | any version |
| nvd | netapp | oncommand insight | generic | any version |
| nvd | netapp | oncommand unified manager | generic | any version |
| nvd | netapp | oncommand unified manager core package | generic | any version |
| nvd | netapp | oncommand workflow automation | generic | any version |
| nvd | netapp | ontap select deploy | generic | any version |
| nvd | netapp | ontap select deploy administration utility | generic | any version |
| nvd | netapp | santricity smi-s provider | generic | any version |
| nvd | netapp | service processor | generic | any version |
| nvd | netapp | smi-s provider | generic | any version |
| nvd | netapp | snapcenter | generic | any version |
| nvd | netapp | snapdrive | generic | any version |
| nvd | netapp | snapprotect | generic | any version |
| nvd | netapp | solidfire | generic | any version |
| nvd | netapp | steelstore cloud integrated storage | generic | any version |
| nvd | netapp | storage automation store | generic | any version |
| nvd | netapp | storagegrid | generic | any version · ≥ 9.0.0 and ≤ 9.0.4 |
| nvd | nodejs | node.js | generic | ≥ 6.0.0 and ≤ 6.8.1 · ≥ 6.9.0 and ＜ 6.17.0 · ≥ 8.0.0 and ≤ 8.8.1 · ≥ 8.9.0 and ＜ 8.15.1 |
| nvd | openssl | openssl | generic | ≥ 1.0.2 and ＜ 1.0.2 |
| nvd | opensuse | leap | generic | 15.0 · 15.1 · 42.3 |
| nvd | oracle | api gateway | generic | 11.1.2.4.0 |
| nvd | oracle | business intelligence | generic | 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | oracle | communications diameter signaling router | generic | 8.0.0 · 8.1 · 8.2 · 8.3 · 8.4 |
| nvd | oracle | communications performance intelligence center | generic | 10.4.0.2 |
| nvd | oracle | communications session border controller | generic | 7.4 · 8.0.0 · 8.1.0 · 8.2 · 8.3 |
| nvd | oracle | communications session router | generic | 7.4 · 8.0 · 8.1 · 8.2 · 8.3 |
| nvd | oracle | communications unified session manager | generic | 7.3.5 · 8.2.5 |
| nvd | oracle | endeca server | generic | 7.7.0 |
| nvd | oracle | enterprise manager base platform | generic | 12.1.0.5.0 · 13.2.0.0.0 · 13.3.0.0.0 |
| nvd | oracle | enterprise manager ops center | generic | 12.3.3 · 12.4.0 |
| nvd | oracle | jd edwards enterpriseone tools | generic | 9.2 |
| nvd | oracle | jd edwards world security | generic | a9.3 · a9.3.1 · a9.4 |
| nvd | oracle | mysql | generic | ≥ 5.6.0 and ≤ 5.6.43 · ≥ 5.7.0 and ≤ 5.7.25 · ≥ 8.0.0 and ≤ 8.0.15 |
| nvd | oracle | mysql enterprise monitor | generic | ≤ 4.0.8 · ≥ 8.0.0 and ≤ 8.0.14 |
| nvd | oracle | mysql workbench | generic | ≤ 8.0.16 |
| nvd | oracle | peoplesoft enterprise peopletools | generic | 8.55 · 8.56 · 8.57 |
| nvd | oracle | secure global desktop | generic | 5.4 |
| nvd | oracle | services tools bundle | generic | 19.2 |
| nvd | paloaltonetworks | pan-os | generic | ≥ 7.1.0 and ＜ 7.1.15 · ≥ 8.0.0 and ＜ 8.0.20 · ≥ 8.1.0 and ＜ 8.1.8 · ≥ 9.0.0 and ＜ 9.0.2 |
| nvd | redhat | enterprise linux desktop | generic | 6.0 · 7.0 |
| nvd | redhat | enterprise linux server | generic | 6.0 · 7.0 |
| nvd | redhat | enterprise linux workstation | generic | 6.0 · 7.0 |
| nvd | redhat | jboss enterprise web server | generic | 5.0.0 |
| nvd | redhat | virtualization | generic | 4.0 |
| nvd | redhat | virtualization host | generic | 4.0 |
| nvd | tenable | nessus | generic | ≤ 8.2.3 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** MYSQL PROTOCOL, ORACLE API GATEWAY (OPENSSL), SECURITY (OPENSSL), NO AUTH REMOTE EXPLOIT, PLATFORM (OPENSSL), UTILITIES (OPENSSL), CORE (OPENSSL), MYSQL WORKBENCH (OPENSSL), JDENET, SEE NOTE 1, PRODUCT CODE (OPENSSL), CONNECTOR/ODBC (OPENSSL), SECURITY VULNERABILITY (OPENSSL), MONITORING: GENERAL (OPENSSL), MYSQL WORKBENCH, SECURE STORE (OPENSSL), DISCOVERY FRAMEWORK (OPENSSL), NETWORKING (OPENSSL), ROUTING (OPENSSL), SERVER: COMPILING (OPENSSL), ANALYTICS SERVER AND ANALYTICS WEB GENERAL (OPENSSL), HTTPS, TLS, ENTERPRISE INFRASTRUCTURE SEC (OPENSSL) **Products:** ORACLE SUPPORT TOOLS, MYSQL CONNECTORS, ORACLE COMMUNICATIONS PERFORMANCE INTELLIGENCE CENTER (PIC) SOFTWARE, ORACLE ENDECA SERVER, ORACLE MYSQL, ORACLE SECURE GLOBAL DESKTOP, ENTERPRISE MANAGER OPS CENTER, ORACLE COMMUNICATIONS SESSION ROUTER, ORACLE API GATEWAY, ENTERPRISE MANAGER BASE PLATFORM, SERVICES TOOLS BUNDLE, ORACLE BUSINESS INTELLIGENCE ENTERPRISE EDITION, ORACLE JD EDWARDS PRODUCTS, ORACLE COMMUNICATIONS UNIFIED SESSION MANAGER, MYSQL WORKBENCH, ORACLE VIRTUALIZATION, ORACLE COMMUNICATIONS DIAMETER SIGNALING ROUTER (DSR), MYSQL ENTERPRISE MONITOR, ORACLE FUSION MIDDLEWARE, ORACLE COMMUNICATIONS, ORACLE COMMUNICATIONS SESSION BORDER CONTROLLER, ORACLE PEOPLESOFT PRODUCTS, MYSQL SERVER, PEOPLESOFT ENTERPRISE PEOPLETOOLS, OPENSSL, ORACLE COMMUNICATIONS APPLICATIONS, JD EDWARDS WORLD SECURITY, JD EDWARDS ENTERPRISEONE TOOLS, ORACLE ENTERPRISE MANAGER PRODUCTS SUITE
References
| URL | Tags |
|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html | Mailing List, Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html | Mailing List, Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html | Mailing List, Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html | Mailing List, Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html | Mailing List, Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html | Mailing List, Third Party Advisory |
| http://www.securityfocus.com/bid/107174 | Third Party Advisory, VDB Entry |
| https://access.redhat.com/errata/RHSA-2019:2304 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2019:2437 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2019:2439 | Third Party Advisory |
Timeline
Timeline
| Published | 2019-02-27 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |