CVE-2019-1551 - 漏洞详情

CVE-2019-1551 (CNNVD-201912-272)

MEDIUM

中文标题:

OpenSSL 输入验证错误漏洞

英文标题:

rsaz_512_sqr overflow bug on x86_64

CVSS分数: 5.3

发布时间: 2019-12-06 17:20:14

漏洞类型: 输入验证错误

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

OpenSSL是Openssl团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL 1.1.1版本至1.1.1d版本和1.0.2版本至1.0.2t版本中存在输入验证错误漏洞。该漏洞源于网络系统或产品在运行过程中存在配置等错误。未授权的攻击者可利用漏洞获取受影响组件敏感信息。

英文描述:

There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).

CWE类型:

CWE-190

受影响产品

厂商	产品	版本	版本范围	平台	CPE
OpenSSL	OpenSSL	Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d)	-	-	`cpe:2.3:a:openssl:openssl:fixed_in_openssl_1.1.1e_(affected_1.1.1-1.1.1d):::::::*`
OpenSSL	OpenSSL	Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t)	-	-	`cpe:2.3:a:openssl:openssl:fixed_in_openssl_1.0.2u_(affected_1.0.2-1.0.2t):::::::*`
openssl	openssl	*	-	-	`cpe:2.3:a:openssl:openssl::::::::`
opensuse	leap	15.1	-	-	`cpe:2.3:o:opensuse:leap:15.1:::::::*`
oracle	enterprise_manager_ops_center	12.4.0.0	-	-	`cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:::::::*`
oracle	mysql_enterprise_monitor	*	-	-	`cpe:2.3:a:oracle:mysql_enterprise_monitor::::::::`
oracle	peoplesoft_enterprise_peopletools	8.56	-	-	`cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:::::::*`
oracle	peoplesoft_enterprise_peopletools	8.57	-	-	`cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:::::::*`
oracle	peoplesoft_enterprise_peopletools	8.58	-	-	`cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:::::::*`
canonical	ubuntu_linux	16.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::`
canonical	ubuntu_linux	18.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::`
canonical	ubuntu_linux	19.10	-	-	`cpe:2.3:o:canonical:ubuntu_linux:19.10:::::::*`
fedoraproject	fedora	30	-	-	`cpe:2.3:o:fedoraproject:fedora:30:::::::*`
fedoraproject	fedora	31	-	-	`cpe:2.3:o:fedoraproject:fedora:31:::::::*`
fedoraproject	fedora	32	-	-	`cpe:2.3:o:fedoraproject:fedora:32:::::::*`
debian	debian_linux	9.0	-	-	`cpe:2.3:o:debian:debian_linux:9.0:::::::*`
debian	debian_linux	10.0	-	-	`cpe:2.3:o:debian:debian_linux:10.0:::::::*`
tenable	log_correlation_engine	*	-	-	`cpe:2.3:a:tenable:log_correlation_engine::::::::`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

20191225 [slackware-security] openssl (SSA:2019-354-01) mailing-list
cve.org

访问

DSA-4594 vendor-advisory
cve.org

访问

20191229 [SECURITY] [DSA 4594-1] openssl1.0 security update mailing-list
cve.org

访问

openSUSE-SU-2020:0062 vendor-advisory
cve.org

访问

GLSA-202004-10 vendor-advisory
cve.org

访问

FEDORA-2020-fcc91a28e8 vendor-advisory
cve.org

访问

FEDORA-2020-da2d1ef2d7 vendor-advisory
cve.org

访问

FEDORA-2020-d7b29838f6 vendor-advisory
cve.org

访问

USN-4376-1 vendor-advisory
cve.org

访问

无标题 x_refsource_MISC
cve.org

访问