Skip to content
OpenAdvisories
Unscored RHSA-2020:1840 3 CVEs

Red Hat Security Advisory: openssl security and bug fix update

Published Oct 1, 2024 · Updated Sep 21, 2026

Ecosystem: Red Hat

Fixed packages 7

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::baseos openssl 1:1.1.1c-15.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos openssl-debuginfo 1:1.1.1c-15.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos openssl-debugsource 1:1.1.1c-15.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos openssl-devel 1:1.1.1c-15.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos openssl-libs 1:1.1.1c-15.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos openssl-libs-debuginfo 1:1.1.1c-15.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos openssl-perl 1:1.1.1c-15.el8

Vulnerabilities 3

  • Unscored —
    CVE-2019-1547

    ECDSA remote timing attack

    Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is p…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-1549

    Fork Protection

    OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection w…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-1563

    Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey

    In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1735738
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1741285
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1741317
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1741641
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1749068
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1749790
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1752090
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1752095
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1752100
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1758587
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1793984
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1840.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-1547
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-1547
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-1547
  • report
    https://access.redhat.com/security/cve/CVE-2019-1549
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-1549
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-1549
  • report
    https://access.redhat.com/security/cve/CVE-2019-1563
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-1563
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-1563