Read the docs
TI-2019-01190 Aliases CVE-2019-1559GHSA-9ccq-7hvh-cv7p

0-byte record padding oracle

Priority MEDIUM 43CWE-203Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 24 fixed, 9 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-203.

Summary

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

Why it matters now

EPSS 0.17139 97th percentileScored 2026-11-07
Fix Partial Red Hat: 6 advisoriesRed Hat: 24 fixed, 9 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenSSLOpenSSLFixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)—No fix listedCNA
  • OpenSSL VendorOpenSSL Affected Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q) Fixed in — No fix listed CNA

CPE configurations NVD · 133

CPEVersionsRoleVendor
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*1.0.2 to before 1.0.2rVulnerableOpenSSL
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*18.10VulnerableCanonical
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*7.3VulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*9.5VulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:altavault:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* Versions 1.0.2 to before 1.0.2r Vulnerable ·OpenSSL
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* Versions 18.10 Vulnerable ·Canonical
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* Versions 7.3 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* Versions 9.5 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:altavault:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 123 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:hyper_converged_infrastructure:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_unified_manager_core_package:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:ontap_select_deploy:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:service_processor:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:unix:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:windows:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapprotect:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*9.0.0 – 9.0.4VulnerableNetApp
cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0VulnerableF5
cpe:2.3:a:f5:big-iq_centralized_management:*:*:*:*:*:*:*:*6.0.0 – 6.1.0; 7.0.0 – 7.1.0VulnerableF5
cpe:2.3:a:f5:traffix_signaling_delivery_controller:*:*:*:*:*:*:*:*5.0.0 – 5.1.0VulnerableF5
cpe:2.3:a:f5:traffix_signaling_delivery_controller:4.4.0:*:*:*:*:*:*:*4.4.0VulnerableF5
cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*up to 8.2.3VulnerableTenable
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*15.0VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*42.3VulnerableopenSUSE
cpe:2.3:o:netapp:cn1610_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:cn1610:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:a320_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:a320:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:c190_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:c190:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:a220_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:a220:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:fas2720_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:fas2720:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:fas2750_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:fas2750:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:a800_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:a800:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*29VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:a:mcafee:agent:*:*:*:*:*:*:*:*5.6.0 – 5.6.4VulnerableMcAfee
cpe:2.3:a:mcafee:data_exchange_layer:*:*:*:*:*:*:*:*4.0.0 to before 6.0.0VulnerableMcAfee
cpe:2.3:a:mcafee:threat_intelligence_exchange_server:*:*:*:*:*:*:*:*2.0.0 to before 3.0.0VulnerableMcAfee
cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*7.0.0 to before 9.0.0VulnerableMcAfee
cpe:2.3:a:redhat:jboss_enterprise_web_server:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*11.1.2.4.0VulnerableOracle
cpe:2.3:a:oracle:business_intelligence:11.1.1.9.0:*:*:*:enterprise:*:*:*11.1.1.9.0VulnerableOracle
cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0.0:*:*:*:*:*:*:*8.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.1:*:*:*:*:*:*:*8.1VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2:*:*:*:*:*:*:*8.2VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.3:*:*:*:*:*:*:*8.3VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.4:*:*:*:*:*:*:*8.4VulnerableOracle
cpe:2.3:a:oracle:communications_performance_intelligence_center:10.4.0.2:*:*:*:*:*:*:*10.4.0.2VulnerableOracle
cpe:2.3:a:oracle:communications_session_border_controller:7.4:*:*:*:*:*:*:*7.4VulnerableOracle
cpe:2.3:a:oracle:communications_session_border_controller:8.0.0:*:*:*:*:*:*:*8.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_border_controller:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_border_controller:8.2:*:*:*:*:*:*:*8.2VulnerableOracle
cpe:2.3:a:oracle:communications_session_border_controller:8.3:*:*:*:*:*:*:*8.3VulnerableOracle
cpe:2.3:a:oracle:communications_session_router:7.4:*:*:*:*:*:*:*7.4VulnerableOracle
cpe:2.3:a:oracle:communications_session_router:8.0:*:*:*:*:*:*:*8.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_router:8.1:*:*:*:*:*:*:*8.1VulnerableOracle
cpe:2.3:a:oracle:communications_session_router:8.2:*:*:*:*:*:*:*8.2VulnerableOracle
cpe:2.3:a:oracle:communications_session_router:8.3:*:*:*:*:*:*:*8.3VulnerableOracle
cpe:2.3:a:oracle:communications_unified_session_manager:7.3.5:*:*:*:*:*:*:*7.3.5VulnerableOracle
cpe:2.3:a:oracle:communications_unified_session_manager:8.2.5:*:*:*:*:*:*:*8.2.5VulnerableOracle
cpe:2.3:a:oracle:endeca_server:7.7.0:*:*:*:*:*:*:*7.7.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5.0:*:*:*:*:*:*:*12.1.0.5.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0.0:*:*:*:*:*:*:*13.2.0.0.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0.0:*:*:*:*:*:*:*13.3.0.0.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*12.3.3VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*12.4.0VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*9.2VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_world_security:a9.3:*:*:*:*:*:*:*a9.3VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_world_security:a9.3.1:*:*:*:*:*:*:*a9.3.1VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*a9.4VulnerableOracle
cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*5.6.0 – 5.6.43; 5.7.0 – 5.7.25; 8.0.0 – 8.0.15VulnerableOracle
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*up to 4.0.8; 8.0.0 – 8.0.14VulnerableOracle
cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*up to 8.0.16VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:*8.55VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*8.56VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*8.57VulnerableOracle
cpe:2.3:a:oracle:secure_global_desktop:5.4:*:*:*:*:*:*:*5.4VulnerableOracle
cpe:2.3:a:oracle:services_tools_bundle:19.2:*:*:*:*:*:*:*19.2VulnerableOracle
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*7.1.0 to before 7.1.15; 8.0.0 to before 8.0.20; 8.1.0 to before 8.1.8; 9.0.0 to before 9.0.2VulnerableCyberArk Software, a Palo Alto Networks Company
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*6.0.0 – 6.8.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*6.9.0 to before 6.17.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*8.0.0 – 8.8.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*8.9.0 to before 8.15.1VulnerableNodeJS
  • cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:hyper_converged_infrastructure:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_unified_manager_core_package:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:ontap_select_deploy:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:service_processor:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:unix:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapprotect:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:* Versions 9.0.0 – 9.0.4 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* Versions 12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* Versions 12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* Versions 12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* Versions 12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* Versions 12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* Versions 12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* Versions 12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* Versions 12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* Versions 12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* Versions 12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* Versions 12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* Versions 12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* Versions 12.1.0 – 12.1.5; 13.0.0 – 13.1.3; 14.0.0 – 14.1.2; 15.0.0 – 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-iq_centralized_management:*:*:*:*:*:*:*:* Versions 6.0.0 – 6.1.0; 7.0.0 – 7.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:traffix_signaling_delivery_controller:*:*:*:*:*:*:*:* Versions 5.0.0 – 5.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:traffix_signaling_delivery_controller:4.4.0:*:*:*:*:*:*:* Versions 4.4.0 Vulnerable ·F5
  • cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:* Versions up to 8.2.3 Vulnerable ·Tenable
  • cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:* Versions 42.3 Vulnerable ·openSUSE
  • cpe:2.3:o:netapp:cn1610_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:cn1610:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:a320_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:a320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:c190_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:c190:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:a220_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:a220:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:fas2720_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:fas2720:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:fas2750_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:fas2750:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:a800_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:a800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:a:mcafee:agent:*:*:*:*:*:*:*:* Versions 5.6.0 – 5.6.4 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:data_exchange_layer:*:*:*:*:*:*:*:* Versions 4.0.0 to before 6.0.0 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:threat_intelligence_exchange_server:*:*:*:*:*:*:*:* Versions 2.0.0 to before 3.0.0 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:* Versions 7.0.0 to before 9.0.0 Vulnerable ·McAfee
  • cpe:2.3:a:redhat:jboss_enterprise_web_server:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:* Versions 11.1.2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_intelligence:11.1.1.9.0:*:*:*:enterprise:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:8.3:*:*:*:*:*:*:* Versions 8.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_performance_intelligence_center:10.4.0.2:*:*:*:*:*:*:* Versions 10.4.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_border_controller:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_border_controller:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_border_controller:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_border_controller:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_border_controller:8.3:*:*:*:*:*:*:* Versions 8.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_router:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_router:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_router:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_router:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_router:8.3:*:*:*:*:*:*:* Versions 8.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_session_manager:7.3.5:*:*:*:*:*:*:* Versions 7.3.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_session_manager:8.2.5:*:*:*:*:*:*:* Versions 8.2.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:endeca_server:7.7.0:*:*:*:*:*:*:* Versions 7.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5.0:*:*:*:*:*:*:* Versions 12.1.0.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0.0:*:*:*:*:*:*:* Versions 13.2.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0.0:*:*:*:*:*:*:* Versions 13.3.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* Versions 12.3.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:* Versions 12.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_world_security:a9.3:*:*:*:*:*:*:* Versions a9.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_world_security:a9.3.1:*:*:*:*:*:*:* Versions a9.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:* Versions a9.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* Versions 5.6.0 – 5.6.43; 5.7.0 – 5.7.25; 8.0.0 – 8.0.15 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 4.0.8; 8.0.0 – 8.0.14 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* Versions up to 8.0.16 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:* Versions 8.55 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* Versions 8.56 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:secure_global_desktop:5.4:*:*:*:*:*:*:* Versions 5.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:services_tools_bundle:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
  • cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* Versions 7.1.0 to before 7.1.15; 8.0.0 to before 8.0.20; 8.1.0 to before 8.1.8; 9.0.0 to before 9.0.2 Vulnerable ·CyberArk Software, a Palo Alto Networks Company
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 6.0.0 – 6.8.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 6.9.0 to before 6.17.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 8.0.0 – 8.8.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 8.9.0 to before 8.15.1 Vulnerable ·NodeJS

Remediation

Red Hat 6 advisories

  • RHSA-2019:3929 Released 2019-11-20 · Red Hat rating Important
    Red Hat JBoss Web Server 5.2 security release
    • Red Hat JBoss Web Server 5.2 for RHEL 6 Server jws5-ecj-4.12.0-1.redhat_1.1.el6jws, jws5-javapackages-tools-3.4.1-5.15.11.el6jws, jws5-jboss-logging-3.3.2-1.Final_redhat_00001.1.el6jws +16
    • Red Hat JBoss Web Server 5.2 for RHEL 7 Server jws5-ecj-4.12.0-1.redhat_1.1.el7jws, jws5-javapackages-tools-3.4.1-5.15.11.el7jws, jws5-jboss-logging-3.3.2-1.Final_redhat_00001.1.el7jws +16
    • Red Hat JBoss Web Server 5.2 for RHEL 8 jws5-ecj-4.12.0-1.redhat_1.1.el8jws, jws5-javapackages-tools-3.4.1-5.15.11.el8jws, jws5-jboss-logging-3.3.2-1.Final_redhat_00001.1.el8jws +16
  • RHSA-2019:3931 Released 2019-11-20 · Red Hat rating Important
    Red Hat JBoss Web Server 5.2 security release
    • Red Hat JBoss Web Server 5
  • RHSA-2019:2471 Released 2019-08-13 · Red Hat rating Moderate
    openssl security update
    • Red Hat Enterprise Linux Desktop (v. 6) openssl-1.0.1e-58.el6_10
    • Red Hat Enterprise Linux Desktop Optional (v. 6) openssl-devel-1.0.1e-58.el6_10, openssl-perl-1.0.1e-58.el6_10, openssl-static-1.0.1e-58.el6_10
    • Red Hat Enterprise Linux HPC Node (v. 6) openssl-1.0.1e-58.el6_10
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) openssl-devel-1.0.1e-58.el6_10, openssl-perl-1.0.1e-58.el6_10, openssl-static-1.0.1e-58.el6_10
    • Red Hat Enterprise Linux Server (v. 6) openssl-1.0.1e-58.el6_10, openssl-1.0.1e-58.el6_10.ppc, openssl-devel-1.0.1e-58.el6_10 +1
    • Red Hat Enterprise Linux Server Optional (v. 6) openssl-perl-1.0.1e-58.el6_10, openssl-static-1.0.1e-58.el6_10
    • Red Hat Enterprise Linux Workstation (v. 6) openssl-1.0.1e-58.el6_10, openssl-devel-1.0.1e-58.el6_10
    • Red Hat Enterprise Linux Workstation Optional (v. 6) openssl-perl-1.0.1e-58.el6_10, openssl-static-1.0.1e-58.el6_10
Show 3 more Red Hat advisories
  • RHSA-2019:2437 Released 2019-08-12 · Red Hat rating Important
    Red Hat Virtualization security update
    • RHEL 7-based RHEV-H for RHEV 4 (build requirements) imgbased-1.1.9-0.1.el7ev, ovirt-node-ng-4.3.5-0.20190717.0.el7ev, ovirt-node-ng-nodectl-4.3.5-0.20190717.0.el7ev +4
    • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host-4.3.5-20190722.0.el7_7, redhat-virtualization-host-image-update-4.3.5-20190722.0.el7_7
  • RHSA-2019:2439 Released 2019-08-12 · Red Hat rating Moderate
    rhvm-appliance security, bug fix, and enhancement update
    • Red Hat Virtualization 4 Hypervisor for RHEL 7 rhvm-appliance-2:4.3-20190722.0.el7
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts rhvm-appliance-2:4.3-20190722.0.el7
  • RHSA-2019:2304 Released 2019-08-06 · Red Hat rating Moderate
    openssl security and bug fix update
    • Red Hat Enterprise Linux Client (v. 7) openssl-1:1.0.2k-19.el7, openssl-libs-1:1.0.2k-19.el7
    • Red Hat Enterprise Linux Client Optional (v. 7) openssl-devel-1:1.0.2k-19.el7, openssl-perl-1:1.0.2k-19.el7, openssl-static-1:1.0.2k-19.el7
    • Red Hat Enterprise Linux ComputeNode (v. 7) openssl-1:1.0.2k-19.el7, openssl-libs-1:1.0.2k-19.el7
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-devel-1:1.0.2k-19.el7, openssl-perl-1:1.0.2k-19.el7, openssl-static-1:1.0.2k-19.el7
    • Red Hat Enterprise Linux Server (v. 7) openssl-1:1.0.2k-19.el7, openssl-devel-1:1.0.2k-19.el7, openssl-devel-1:1.0.2k-19.el7.ppc +2
    • Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl-1:1.0.2k-19.el7, openssl-static-1:1.0.2k-19.el7, openssl-static-1:1.0.2k-19.el7.ppc
    • Red Hat Enterprise Linux Workstation (v. 7) openssl-1:1.0.2k-19.el7, openssl-devel-1:1.0.2k-19.el7, openssl-libs-1:1.0.2k-19.el7
    • Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl-1:1.0.2k-19.el7, openssl-static-1:1.0.2k-19.el7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat JBoss Core ServicesAffectedNo fix yet
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Web Server 2AffectedNo fix planned: Will not fix
Red Hat JBoss Web Server 3AffectedNo fix planned: Out of support scope
RHEL 7-based RHEV-H for RHEV 4 (build requirements)Fixed RHSA-2019:2437
Red Hat Ansible Tower 3.4 for RHEL 7 ServerFixed—
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2019:2304
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2019:2304
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2019:2304
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2019:2304
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2019:2471
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2019:2471
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2019:2471
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2019:2471
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2019:2471
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:2304
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2019:2471
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2019:2304
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2019:2471
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:2304
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2019:2471
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2019:2304
Red Hat JBoss Web Server 5Fixed RHSA-2019:3931
Red Hat JBoss Web Server 5.2 for RHEL 6 ServerFixed RHSA-2019:3929
Red Hat JBoss Web Server 5.2 for RHEL 7 ServerFixed RHSA-2019:3929
Red Hat JBoss Web Server 5.2 for RHEL 8Fixed RHSA-2019:3929
Red Hat Virtualization 4 Hypervisor for RHEL 7Fixed RHSA-2019:2437, RHSA-2019:2439
Red Hat Virtualization 4 Management Agent for RHEL 7 HostsFixed RHSA-2019:2439
Not affected: 1 product
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1559
  2. 2026-10-03 Alias added: GHSA-9ccq-7hvh-cv7p

References

Patch 5

Advisory 28

Other 2

  • TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
  • TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
  • TI-2022-01176 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
  • TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
  • TI-2025-14107 Stack buffer overflow in CMS (Auth)EnvelopedData parsing CVSS 3.1HIGH 8.8
See all 312 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences