CVE-2019-1559

Published: Feb 27, 2019Modified: Jun 17, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

Affected (169)

Products: Openssl: Openssl · Canonical: Ubuntu Linux · Debian: Debian Linux · +10 more

Show all products

Openssl: Openssl · Canonical: Ubuntu Linux · Debian: Debian Linux · Netapp: Active Iq Unified Manager, Altavault, Cloud Backup, Clustered Data Ontap Antivirus Connector, Element Software, Hci Compute Node, Hci Management Node, Hyper Converged Infrastructure, Oncommand Insight, Oncommand Unified Manager, Oncommand Unified Manager Core Package, Oncommand Workflow Automation, Ontap Select Deploy, Ontap Select Deploy Administration Utility, Santricity Smi S Provider, Service Processor, Smi S Provider, Snapcenter, Snapdrive, Snapprotect, Solidfire, Steelstore Cloud Integrated Storage, Storage Automation Store, Storagegrid, Cn1610 Firmware, A320 Firmware, C190 Firmware, A220 Firmware, Fas2720 Firmware, Fas2750 Firmware, A800 Firmware · F5: Big Ip Access Policy Manager, Big Ip Advanced Firewall Manager, Big Ip Analytics, Big Ip Application Acceleration Manager, Big Ip Application Security Manager, Big Ip Domain Name System, Big Ip Edge Gateway, Big Ip Fraud Protection Service, Big Ip Global Traffic Manager, Big Ip Link Controller, Big Ip Local Traffic Manager, Big Ip Policy Enforcement Manager, Big Ip Webaccelerator, Big Iq Centralized Management, Traffix Signaling Delivery Controller · Tenable: Nessus · Opensuse: Leap · Fedoraproject: Fedora · Mcafee: Agent, Data Exchange Layer, Threat Intelligence Exchange Server, Web Gateway · Redhat: Jboss Enterprise Web Server, Virtualization, Virtualization Host, Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Workstation · Oracle: Api Gateway, Business Intelligence, Communications Diameter Signaling Router, Communications Performance Intelligence Center, Communications Session Border Controller, Communications Session Router, Communications Unified Session Manager, Endeca Server, Enterprise Manager Base Platform, Enterprise Manager Ops Center, Jd Edwards Enterpriseone Tools, Jd Edwards World Security, Mysql, Mysql Enterprise Monitor, Mysql Workbench, Peoplesoft Enterprise Peopletools, Secure Global Desktop, Services Tools Bundle · Paloaltonetworks: Pan Os · Nodejs: Node.js

1 product

1 product

1 product

31 products

Active Iq Unified Manager

Altavault

Cloud Backup

Clustered Data Ontap Antivirus Connector

Element Software

Hci Compute Node

Hci Management Node

Hyper Converged Infrastructure

Oncommand Insight

Oncommand Unified Manager

Oncommand Unified Manager Core Package

Oncommand Workflow Automation

Ontap Select Deploy

Ontap Select Deploy Administration Utility

Santricity Smi S Provider

Steelstore Cloud Integrated Storage

Storage Automation Store

15 products

Big Ip Access Policy Manager

Big Ip Advanced Firewall Manager

Big Ip Analytics

Big Ip Application Acceleration Manager

Big Ip Application Security Manager

Big Ip Domain Name System

Big Ip Edge Gateway

Big Ip Fraud Protection Service

Big Ip Global Traffic Manager

Big Ip Link Controller

Big Ip Local Traffic Manager

Big Ip Policy Enforcement Manager

Big Ip Webaccelerator

Big Iq Centralized Management

Traffix Signaling Delivery Controller

1 product

1 product

1 product

4 products

Threat Intelligence Exchange Server

Web Gateway

Redhat

6 products

Jboss Enterprise Web Server

Virtualization

Virtualization Host

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Workstation

Oracle

18 products

Api Gateway

Business Intelligence

Communications Diameter Signaling Router

Communications Performance Intelligence Center

Communications Session Border Controller

Communications Session Router

Communications Unified Session Manager

Endeca Server

Enterprise Manager Base Platform

Enterprise Manager Ops Center

Jd Edwards Enterpriseone Tools

Jd Edwards World Security

Mysql

Mysql Enterprise Monitor

Mysql Workbench

Peoplesoft Enterprise Peopletools

Secure Global Desktop

Services Tools Bundle

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	From 1.0.2 to 1.0.2r

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 18.10

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration D

29 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	From 9.5
Netapp Active Iq Unified Manager	From 7.3
Netapp Active Iq Unified Manager	All versions
Netapp Altavault	All versions
Netapp Cloud Backup	All versions
Netapp Clustered Data Ontap Antivirus Connector	All versions
Netapp Element Software	All versions
Netapp Hci Compute Node	All versions
Netapp Hci Management Node	All versions
Netapp Hyper Converged Infrastructure	All versions
Netapp Oncommand Insight	All versions
Netapp Oncommand Unified Manager	All versions
Netapp Oncommand Unified Manager	All versions
Netapp Oncommand Unified Manager Core Package	All versions
Netapp Oncommand Workflow Automation	All versions
Netapp Ontap Select Deploy	All versions
Netapp Ontap Select Deploy Administration Utility	All versions
Netapp Santricity Smi S Provider	All versions
Netapp Service Processor	All versions
Netapp Smi S Provider	All versions
Netapp Snapcenter	All versions
Netapp Snapdrive	All versions
Netapp Snapdrive	All versions
Netapp Snapprotect	All versions
Netapp Solidfire	All versions
Netapp Steelstore Cloud Integrated Storage	All versions
Netapp Storage Automation Store	All versions
Netapp Storagegrid	From 9.0.0 to 9.0.4
Netapp Storagegrid	All versions

Configuration E

56 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Access Policy Manager	From 12.1.0 to 12.1.5
F5 Big Ip Access Policy Manager	From 13.0.0 to 13.1.3
F5 Big Ip Access Policy Manager	From 14.0.0 to 14.1.2
F5 Big Ip Access Policy Manager	From 15.0.0 to 15.1.0
F5 Big Ip Advanced Firewall Manager	From 12.1.0 to 12.1.5
F5 Big Ip Advanced Firewall Manager	From 13.0.0 to 13.1.3
F5 Big Ip Advanced Firewall Manager	From 14.0.0 to 14.1.2
F5 Big Ip Advanced Firewall Manager	From 15.0.0 to 15.1.0
F5 Big Ip Analytics	From 12.1.0 to 12.1.5
F5 Big Ip Analytics	From 13.0.0 to 13.1.3
F5 Big Ip Analytics	From 14.0.0 to 14.1.2
F5 Big Ip Analytics	From 15.0.0 to 15.1.0
F5 Big Ip Application Acceleration Manager	From 12.1.0 to 12.1.5
F5 Big Ip Application Acceleration Manager	From 13.0.0 to 13.1.3
F5 Big Ip Application Acceleration Manager	From 14.0.0 to 14.1.2
F5 Big Ip Application Acceleration Manager	From 15.0.0 to 15.1.0
F5 Big Ip Application Security Manager	From 12.1.0 to 12.1.5
F5 Big Ip Application Security Manager	From 13.0.0 to 13.1.3
F5 Big Ip Application Security Manager	From 14.0.0 to 14.1.2
F5 Big Ip Application Security Manager	From 15.0.0 to 15.1.0
F5 Big Ip Domain Name System	From 12.1.0 to 12.1.5
F5 Big Ip Domain Name System	From 13.0.0 to 13.1.3
F5 Big Ip Domain Name System	From 14.0.0 to 14.1.2
F5 Big Ip Domain Name System	From 15.0.0 to 15.1.0
F5 Big Ip Edge Gateway	From 12.1.0 to 12.1.5
F5 Big Ip Edge Gateway	From 13.0.0 to 13.1.3
F5 Big Ip Edge Gateway	From 14.0.0 to 14.1.2
F5 Big Ip Edge Gateway	From 15.0.0 to 15.1.0
F5 Big Ip Fraud Protection Service	From 12.1.0 to 12.1.5
F5 Big Ip Fraud Protection Service	From 13.0.0 to 13.1.3
F5 Big Ip Fraud Protection Service	From 14.0.0 to 14.1.2
F5 Big Ip Fraud Protection Service	From 15.0.0 to 15.1.0
F5 Big Ip Global Traffic Manager	From 12.1.0 to 12.1.5
F5 Big Ip Global Traffic Manager	From 13.0.0 to 13.1.3
F5 Big Ip Global Traffic Manager	From 14.0.0 to 14.1.2
F5 Big Ip Global Traffic Manager	From 15.0.0 to 15.1.0
F5 Big Ip Link Controller	From 12.1.0 to 12.1.5
F5 Big Ip Link Controller	From 13.0.0 to 13.1.3
F5 Big Ip Link Controller	From 14.0.0 to 14.1.2
F5 Big Ip Link Controller	From 15.0.0 to 15.1.0
F5 Big Ip Local Traffic Manager	From 12.1.0 to 12.1.5
F5 Big Ip Local Traffic Manager	From 13.0.0 to 13.1.3
F5 Big Ip Local Traffic Manager	From 14.0.0 to 14.1.2
F5 Big Ip Local Traffic Manager	From 15.0.0 to 15.1.0
F5 Big Ip Policy Enforcement Manager	From 12.1.0 to 12.1.5
F5 Big Ip Policy Enforcement Manager	From 13.0.0 to 13.1.3
F5 Big Ip Policy Enforcement Manager	From 14.0.0 to 14.1.2
F5 Big Ip Policy Enforcement Manager	From 15.0.0 to 15.1.0
F5 Big Ip Webaccelerator	From 12.1.0 to 12.1.5
F5 Big Ip Webaccelerator	From 13.0.0 to 13.1.3
F5 Big Ip Webaccelerator	From 14.0.0 to 14.1.2
F5 Big Ip Webaccelerator	From 15.0.0 to 15.1.0
F5 Big Iq Centralized Management	From 6.0.0 to 6.1.0
F5 Big Iq Centralized Management	From 7.0.0 to 7.1.0
F5 Traffix Signaling Delivery Controller	From 5.0.0 to 5.1.0
F5 Traffix Signaling Delivery Controller	Version 4.4.0

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Tenable Nessus	Up to 8.2.3

Configuration G

3 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.0
Opensuse Leap	Version 15.1
Opensuse Leap	Version 42.3

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Cn1610 Firmware	All versions

Running on/with	Platform Versions
Netapp Cn1610	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A320 Firmware	All versions

Running on/with	Platform Versions
Netapp A320	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp C190 Firmware	All versions

Running on/with	Platform Versions
Netapp C190	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A220 Firmware	All versions

Running on/with	Platform Versions
Netapp A220	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fas2720 Firmware	All versions

Running on/with	Platform Versions
Netapp Fas2720	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fas2750 Firmware	All versions

Running on/with	Platform Versions
Netapp Fas2750	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A800 Firmware	All versions

Running on/with	Platform Versions
Netapp A800	All versions

Configuration O

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 29
Fedoraproject Fedora	Version 30
Fedoraproject Fedora	Version 31

Configuration P

4 vulnerable

Vulnerable Software	Affected Versions
Mcafee Agent	From 5.6.0 to 5.6.4
Mcafee Data Exchange Layer	From 4.0.0 to 6.0.0
Mcafee Threat Intelligence Exchange Server	From 2.0.0 to 3.0.0
Mcafee Web Gateway	From 7.0.0 to 9.0.0

Configuration Q

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Web Server	Version 5.0.0

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 8.0

Configuration R

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Redhat Virtualization	Version 4.0
Redhat Virtualization Host	Version 4.0

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 7.0

Configuration S

6 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Workstation	Version 6.0
Redhat Enterprise Linux Workstation	Version 7.0

Configuration T

43 vulnerable

Vulnerable Software	Affected Versions
Oracle Api Gateway	Version 11.1.2.4.0
Oracle Business Intelligence	Version 11.1.1.9.0
Oracle Business Intelligence	Version 12.2.1.3.0
Oracle Business Intelligence	Version 12.2.1.4.0
Oracle Communications Diameter Signaling Router	Version 8.0.0
Oracle Communications Diameter Signaling Router	Version 8.1
Oracle Communications Diameter Signaling Router	Version 8.2
Oracle Communications Diameter Signaling Router	Version 8.3
Oracle Communications Diameter Signaling Router	Version 8.4
Oracle Communications Performance Intelligence Center	Version 10.4.0.2
Oracle Communications Session Border Controller	Version 7.4
Oracle Communications Session Border Controller	Version 8.0.0
Oracle Communications Session Border Controller	Version 8.1.0
Oracle Communications Session Border Controller	Version 8.2
Oracle Communications Session Border Controller	Version 8.3
Oracle Communications Session Router	Version 7.4
Oracle Communications Session Router	Version 8.0
Oracle Communications Session Router	Version 8.1
Oracle Communications Session Router	Version 8.2
Oracle Communications Session Router	Version 8.3
Oracle Communications Unified Session Manager	Version 7.3.5
Oracle Communications Unified Session Manager	Version 8.2.5
Oracle Endeca Server	Version 7.7.0
Oracle Enterprise Manager Base Platform	Version 12.1.0.5.0
Oracle Enterprise Manager Base Platform	Version 13.2.0.0.0
Oracle Enterprise Manager Base Platform	Version 13.3.0.0.0
Oracle Enterprise Manager Ops Center	Version 12.3.3
Oracle Enterprise Manager Ops Center	Version 12.4.0
Oracle Jd Edwards Enterpriseone Tools	Version 9.2
Oracle Jd Edwards World Security	Version a9.3.1
Oracle Jd Edwards World Security	Version a9.3
Oracle Jd Edwards World Security	Version a9.4
Oracle Mysql	From 5.6.0 to 5.6.43
Oracle Mysql	From 5.7.0 to 5.7.25
Oracle Mysql	From 8.0.0 to 8.0.15
Oracle Mysql Enterprise Monitor	Up to 4.0.8
Oracle Mysql Enterprise Monitor	From 8.0.0 to 8.0.14
Oracle Mysql Workbench	Up to 8.0.16
Oracle Peoplesoft Enterprise Peopletools	Version 8.55
Oracle Peoplesoft Enterprise Peopletools	Version 8.56
Oracle Peoplesoft Enterprise Peopletools	Version 8.57
Oracle Secure Global Desktop	Version 5.4
Oracle Services Tools Bundle	Version 19.2

Configuration U

4 vulnerable

Vulnerable Software	Affected Versions
Paloaltonetworks Pan Os	From 7.1.0 to 7.1.15
Paloaltonetworks Pan Os	From 8.0.0 to 8.0.20
Paloaltonetworks Pan Os	From 8.1.0 to 8.1.8
Paloaltonetworks Pan Os	From 9.0.0 to 9.0.2

Configuration V

4 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 6.0.0 to 6.8.1
Nodejs Node.js	From 8.0.0 to 8.8.1
Nodejs Node.js	From 6.9.0 to 6.17.0
Nodejs Node.js	From 8.9.0 to 8.15.1

Related CWEs

CWE-203

Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.