Summary
Juraj Somorovsky, Robert Merget, and Nimrod Aviram discovered that certain
applications incorrectly used OpenSSL and could be exposed to a padding
oracle attack. A remote attacker could possibly use this issue to decrypt
data.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | openssl | 1.0.2g-1ubuntu4.15 |
| Ubuntu · 18.04 LTS 18.04:LTS | openssl1.0 | 1.0.2n-1ubuntu5.3 |
Vulnerabilities 1
-
Unscored —CVE-2019-1559 EPSS 17%
0-byte record padding oracle
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding …
References
-
report
https://ubuntu.com/security/CVE-2019-1559