fkie_cve-2019-1552
Vulnerability from fkie_nvd
Published
2019-07-30 17:15
Modified
2024-11-21 04:36
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Summary
OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and is configurable with the --prefix / --openssldir configuration options. For OpenSSL versions 1.1.0 and 1.1.1, the mingw configuration targets assume that resulting programs and libraries are installed in a Unix-like environment and the default prefix for program installation as well as for OPENSSLDIR should be '/usr/local'. However, mingw programs are Windows programs, and as such, find themselves looking at sub-directories of 'C:/usr/local', which may be world writable, which enables untrusted users to modify OpenSSL's default configuration, insert CA certificates, modify (or even replace) existing engine modules, etc. For OpenSSL 1.0.2, '/usr/local/ssl' is used as default for OPENSSLDIR on all Unix and Windows targets, including Visual C builds. However, some build instructions for the diverse Windows targets on 1.0.2 encourage you to specify your own --prefix. OpenSSL versions 1.1.1, 1.1.0 and 1.0.2 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
References
openssl-security@openssl.orghttps://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
openssl-security@openssl.orghttps://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=54aa9d51b09d67e90db443f682cface795f5af9e
openssl-security@openssl.orghttps://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=b15a19c148384e73338aa7c5b12652138e35ed28
openssl-security@openssl.orghttps://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=d333ebaf9c77332754a9d5e111e2f53e1de54fdd
openssl-security@openssl.orghttps://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e32bc855a81a2d48d215c506bdeb4f598045f7e9
openssl-security@openssl.orghttps://kc.mcafee.com/corporate/index?page=content&id=SB10365
openssl-security@openssl.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/
openssl-security@openssl.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/
openssl-security@openssl.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/
openssl-security@openssl.orghttps://security.netapp.com/advisory/ntap-20190823-0006/
openssl-security@openssl.orghttps://support.f5.com/csp/article/K94041354
openssl-security@openssl.orghttps://support.f5.com/csp/article/K94041354?utm_source=f5support&amp%3Butm_medium=RSS
openssl-security@openssl.orghttps://www.kb.cert.org/vuls/id/429301
openssl-security@openssl.orghttps://www.openssl.org/news/secadv/20190730.txtVendor Advisory
openssl-security@openssl.orghttps://www.oracle.com/security-alerts/cpuapr2020.html
openssl-security@openssl.orghttps://www.oracle.com/security-alerts/cpujan2020.html
openssl-security@openssl.orghttps://www.oracle.com/security-alerts/cpujul2020.html
openssl-security@openssl.orghttps://www.oracle.com/security-alerts/cpuoct2020.html
openssl-security@openssl.orghttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
openssl-security@openssl.orghttps://www.tenable.com/security/tns-2019-08
openssl-security@openssl.orghttps://www.tenable.com/security/tns-2019-09
af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
af854a3a-2127-422b-91ae-364da2661108https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=54aa9d51b09d67e90db443f682cface795f5af9e
af854a3a-2127-422b-91ae-364da2661108https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=b15a19c148384e73338aa7c5b12652138e35ed28
af854a3a-2127-422b-91ae-364da2661108https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=d333ebaf9c77332754a9d5e111e2f53e1de54fdd
af854a3a-2127-422b-91ae-364da2661108https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e32bc855a81a2d48d215c506bdeb4f598045f7e9
af854a3a-2127-422b-91ae-364da2661108https://kc.mcafee.com/corporate/index?page=content&id=SB10365
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20190823-0006/
af854a3a-2127-422b-91ae-364da2661108https://support.f5.com/csp/article/K94041354
af854a3a-2127-422b-91ae-364da2661108https://support.f5.com/csp/article/K94041354?utm_source=f5support&amp%3Butm_medium=RSS
af854a3a-2127-422b-91ae-364da2661108https://www.kb.cert.org/vuls/id/429301
af854a3a-2127-422b-91ae-364da2661108https://www.openssl.org/news/secadv/20190730.txtVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2020.html
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2020.html
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2020.html
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2020.html
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
af854a3a-2127-422b-91ae-364da2661108https://www.tenable.com/security/tns-2019-08
af854a3a-2127-422b-91ae-364da2661108https://www.tenable.com/security/tns-2019-09
Impacted products
Vendor Product Version
openssl openssl *
openssl openssl *
openssl openssl *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "0DAC8B94-3674-4E4B-9BB0-A16CA0197885",
                     versionEndIncluding: "1.0.2s",
                     versionStartIncluding: "1.0.2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "65728FC6-4B4F-4D43-872B-BE1133BB2281",
                     versionEndIncluding: "1.1.0k",
                     versionStartIncluding: "1.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A2ACA227-3992-478E-85C3-023D8AF88A08",
                     versionEndIncluding: "1.1.1c",
                     versionStartIncluding: "1.1.1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and is configurable with the --prefix / --openssldir configuration options. For OpenSSL versions 1.1.0 and 1.1.1, the mingw configuration targets assume that resulting programs and libraries are installed in a Unix-like environment and the default prefix for program installation as well as for OPENSSLDIR should be '/usr/local'. However, mingw programs are Windows programs, and as such, find themselves looking at sub-directories of 'C:/usr/local', which may be world writable, which enables untrusted users to modify OpenSSL's default configuration, insert CA certificates, modify (or even replace) existing engine modules, etc. For OpenSSL 1.0.2, '/usr/local/ssl' is used as default for OPENSSLDIR on all Unix and Windows targets, including Visual C builds. However, some build instructions for the diverse Windows targets on 1.0.2 encourage you to specify your own --prefix. OpenSSL versions 1.1.1, 1.1.0 and 1.0.2 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).",
      },
      {
         lang: "es",
         value: "OpenSSL presenta valores predeterminados internos para un árbol de directorios donde puede encontrar un archivo de configuración, así como certificados utilizados para la comprobación en TLS. Este directorio se conoce más comúnmente como OPENSSLDIR, y se puede configurar con las opciones de configuración --prefix / --openssldir. Para las versiones 1.1.0 y 1.1.1 de OpenSSL, los destinos de configuración de mingw suponen que los programas y bibliotecas resultantes están instalados en un entorno similar a Unix y el prefijo predeterminado para la instalación del programa, así como para OPENSSLDIR debe ser “/usr/ local”. Sin embargo, los programas mingw son programas de Windows, y como tal, se encuentran buscando subdirectorios de “C:/usr/local”, que pueden ser grabables world, lo que permite a los usuarios no confiables modificar la configuración predeterminada de OpenSSL, insertar certificados de CA, modificar (o incluso reemplazar) los módulos de motor existentes, etc. Para OpenSSL versión 1.0.2, “/usr/local/ssl” se utiliza de por defecto para OPENSSLDIR en todos los Unix y Windows de destino, incluidas las compilaciones de Visual C. Sin embargo, algunas instrucciones de compilación para los diversos Windows de destino en la versión 1.0.2 le incentivan a especificar su propio --prefix. Las versiones 1.1.1, 1.1.0 y 1.0.2 de OpenSSL están afectadas por este problema. Debido al alcance limitado de las implementaciones afectadas, esto se ha evaluado como de baja gravedad y, por lo tanto, no estamos creando nuevas versiones en este momento. Corregido en OpenSSL versión 1.1.1d (versiones afectadas 1.1.1 hasta 1.1.1c). Corregido en OpenSSL versión 1.1.0l (versiones afectadas 1.1.0 hasta 1.1.0k). Corregido en OpenSSL versión 1.0.2t (versiones afectadas 1.0.2 hasta 1.0.2s).",
      },
   ],
   id: "CVE-2019-1552",
   lastModified: "2024-11-21T04:36:48.717",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "LOW",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "LOCAL",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 1.9,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:L/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 3.4,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "NONE",
               integrityImpact: "LOW",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2019-07-30T17:15:12.780",
   references: [
      {
         source: "openssl-security@openssl.org",
         url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=54aa9d51b09d67e90db443f682cface795f5af9e",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=b15a19c148384e73338aa7c5b12652138e35ed28",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=d333ebaf9c77332754a9d5e111e2f53e1de54fdd",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e32bc855a81a2d48d215c506bdeb4f598045f7e9",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10365",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://security.netapp.com/advisory/ntap-20190823-0006/",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://support.f5.com/csp/article/K94041354",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://support.f5.com/csp/article/K94041354?utm_source=f5support&amp%3Butm_medium=RSS",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://www.kb.cert.org/vuls/id/429301",
      },
      {
         source: "openssl-security@openssl.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.openssl.org/news/secadv/20190730.txt",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://www.oracle.com/security-alerts/cpuapr2020.html",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://www.oracle.com/security-alerts/cpujan2020.html",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://www.oracle.com/security-alerts/cpujul2020.html",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://www.tenable.com/security/tns-2019-08",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://www.tenable.com/security/tns-2019-09",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=54aa9d51b09d67e90db443f682cface795f5af9e",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=b15a19c148384e73338aa7c5b12652138e35ed28",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=d333ebaf9c77332754a9d5e111e2f53e1de54fdd",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e32bc855a81a2d48d215c506bdeb4f598045f7e9",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10365",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://security.netapp.com/advisory/ntap-20190823-0006/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://support.f5.com/csp/article/K94041354",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://support.f5.com/csp/article/K94041354?utm_source=f5support&amp%3Butm_medium=RSS",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.kb.cert.org/vuls/id/429301",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.openssl.org/news/secadv/20190730.txt",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.oracle.com/security-alerts/cpuapr2020.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.oracle.com/security-alerts/cpujan2020.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.oracle.com/security-alerts/cpujul2020.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.tenable.com/security/tns-2019-08",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.tenable.com/security/tns-2019-09",
      },
   ],
   sourceIdentifier: "openssl-security@openssl.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-295",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.