CVE-2019-1559— OpenSSL 信息泄露漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2019-1559の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
0-byte record padding oracle
ソース: NVD (National Vulnerability Database)
脆弱性説明
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).
ソース: NVD (National Vulnerability Database)
CVSS情報
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
OpenSSL 信息泄露漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
OpenSSL是Openssl团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL 1.0.2至1.0.2q版本中存在信息泄露漏洞。攻击者可利用该漏洞绕过访问限制，获取敏感信息。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2019-1559の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2019-1559のインテリジェンス情報
请登录查看更多情报信息。
- https://support.f5.com/csp/article/K18549143x_refsource_CONFIRM
- https://security.netapp.com/advisory/ntap-20190301-0002/x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpujan2020.htmlx_refsource_MISC
- https://www.openssl.org/news/secadv/20190226.txtx_refsource_CONFIRM
- https://www.tenable.com/security/tns-2019-03x_refsource_CONFIRM
- https://security.netapp.com/advisory/ntap-20190301-0001/x_refsource_CONFIRM
- https://www.tenable.com/security/tns-2019-02x_refsource_CONFIRM
- https://security.netapp.com/advisory/ntap-20190423-0002/x_refsource_CONFIRM
- https://kc.mcafee.com/corporate/index?page=content&id=SB10282x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpujan2021.htmlx_refsource_MISC
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.htmlvendor-advisoryx_refsource_SUSE
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.htmlvendor-advisoryx_refsource_SUSE
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.htmlvendor-advisoryx_refsource_SUSE
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.htmlvendor-advisoryx_refsource_SUSE
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.htmlvendor-advisoryx_refsource_SUSE
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.htmlvendor-advisoryx_refsource_SUSE
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/vendor-advisoryx_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/vendor-advisoryx_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/vendor-advisoryx_refsource_FEDORA
- https://nvd.nist.gov/vuln/detail/CVE-2019-1559
IV. 関連脆弱性
同じ製品: OpenSSL
- CVE-2026-31790
Incorrect Failure Handling in RSA KEM RSASVE Encapsulation - CVE-2026-31789
Heap Buffer Overflow in Hexadecimal Conversion - CVE-2026-28390
Possible NULL Dereference When Processing CMS KeyTransportRe - CVE-2026-28389
Possible NULL Dereference When Processing CMS KeyAgreeRecipi - CVE-2026-28388
NULL Pointer Dereference When Processing a Delta CRL
同じベンダー: OpenSSL
- CVE-2026-31790
Incorrect Failure Handling in RSA KEM RSASVE Encapsulation - CVE-2026-31789
Heap Buffer Overflow in Hexadecimal Conversion - CVE-2026-28390
Possible NULL Dereference When Processing CMS KeyTransportRe - CVE-2026-28389
Possible NULL Dereference When Processing CMS KeyAgreeRecipi - CVE-2026-28388
NULL Pointer Dereference When Processing a Delta CRL
V. CVE-2019-1559へのコメント
まだコメントはありません