Bugzilla – Bug 1150247
VUL-0: CVE-2019-1549: openssl-1_1: fork problem with random generator
Last modified: 2023-01-17 15:36:52 UTC
CVE-2019-1549 OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1549 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-1549.html http://www.cvedetails.com/cve/CVE-2019-1549/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549 https://www.openssl.org/news/secadv/20190910.txt https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be
Only openssl 1.1.1 is affected, all older versions are not affected. sles12 sp4 and 15sp2 only.
SUSE-SU-2020:0099-1: An update that solves four vulnerabilities and has two fixes is now available. Category: security (moderate) Bug References: 1133925,1140277,1150003,1150247,1150250,1158809 CVE References: CVE-2019-1547,CVE-2019-1549,CVE-2019-1551,CVE-2019-1563 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP5 (src): openssl-1_1-1.1.1d-2.20.1 SUSE Linux Enterprise Software Development Kit 12-SP4 (src): openssl-1_1-1.1.1d-2.20.1 SUSE Linux Enterprise Server 12-SP5 (src): openssl-1_1-1.1.1d-2.20.1 SUSE Linux Enterprise Server 12-SP4 (src): openssl-1_1-1.1.1d-2.20.1 SUSE Linux Enterprise Desktop 12-SP4 (src): openssl-1_1-1.1.1d-2.20.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
done