p PatchFirst

CVE-2019-1549

CVE-2019-1549 · Fork Protection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).

CVSS 5.3 · Medium · EPSS 6.2% · Fix available

Published
Updated

Stack: system · network

Affected products and versions

  • openssl

    Versions
    • Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c): Affected

    No fix published

  • openssl Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.1.1d-1

    Update to 1.1.1d-1

  • openssl Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.1.1d-1

    Update to 1.1.1d-1

  • openssl Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.1.1d-1

    Update to 1.1.1d-1

  • openssl Ubuntu:18.04:LTS

    Versions
    • 1.0.2g-1ubuntu13
    • 1.0.2g-1ubuntu14
    • 1.0.2n-1ubuntu1
    • 1.1.0g-2ubuntu1
    • 1.1.0g-2ubuntu2
    • 1.1.0g-2ubuntu3
    • 1.1.0g-2ubuntu4
    • 1.1.0g-2ubuntu4.1
    • 1.1.0g-2ubuntu4.3
    • 1.1.1-1ubuntu2.1~18.04.1
    • 1.1.1-1ubuntu2.1~18.04.2
    • 1.1.1-1ubuntu2.1~18.04.3
    • 1.1.1-1ubuntu2.1~18.04.4
    • 1.1.1-1ubuntu2.1~18.04.5
    Affected ranges
    • ECOSYSTEM: < 1.1.1-1ubuntu2.1~18.04.6

    Update to 1.1.1-1ubuntu2.1~18.04.6

Original sources

Check your server →