CVE-2019-1549: Fork Protection
Last updated 25 August 2025
Other sources
OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). Th ...
— Debian
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jbcs-httpd24-aprto a version that resolves this vulnerability.Fixed in 0:1.6.3-86.jbcs.el6 - Upgrade
Upgrade
redhat/jbcs-httpd24-brotlito a version that resolves this vulnerability.Fixed in 0:1.0.6-21.jbcs.el6 - Upgrade
Upgrade
redhat/jbcs-httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.37-52.jbcs.el6 - Upgrade
Upgrade
redhat/jbcs-httpd24-opensslto a version that resolves this vulnerability.Fixed in 1:1.1.1c-16.jbcs.el6 - Upgrade
Upgrade
redhat/jbcs-httpd24-aprto a version that resolves this vulnerability.Fixed in 0:1.6.3-86.jbcs.el7 - Upgrade
Upgrade
redhat/jbcs-httpd24-brotlito a version that resolves this vulnerability.Fixed in 0:1.0.6-21.jbcs.el7 - Upgrade
Upgrade
redhat/jbcs-httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.37-52.jbcs.el7 - Upgrade
Upgrade
redhat/jbcs-httpd24-opensslto a version that resolves this vulnerability.Fixed in 1:1.1.1c-16.jbcs.el7 - Upgrade
Upgrade
redhat/opensslto a version that resolves this vulnerability.Fixed in 1:1.1.1c-15.el8 - Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 1.1.1w-0+deb11u1Fixed in 1.1.1w-0+deb11u8Fixed in 3.0.20-1~deb12u1Fixed in 3.0.20-1~deb12u2Fixed in 3.5.6-1~deb13u1Fixed in 3.5.6-1~deb13u2Fixed in 3.6.3-1 - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 1.1.1d - Configuration
Call OPENSSL_init_crypto() explicitly with OPENSSL_INIT_ATFORK (e.g., OPENSSL_init_crypto(..., OPENSSL_INIT_ATFORK)) so the fork protection is enabled and parent/child processes do not share the same RNG state.
OpenSSL OPENSSL_init_crypto() initialization flags (OPENSSL_INIT_ATFORK) = Use OPENSSL_INIT_ATFORK - Compensating control
If OPENSSL_INIT_ATFORK cannot be used, apply the documented partial mitigation of mixing the output from a high precision timer into the RNG state to significantly reduce the likelihood that a parent and child process share the same RNG state.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-1549?
CVE-2019-1549 is a vulnerability in OpenSSL 1.1.1 that affects the random number generator (RNG).
What is the severity of CVE-2019-1549?
CVE-2019-1549 has a severity rating of 5.3, which is considered medium.
How does CVE-2019-1549 affect OpenSSL?
CVE-2019-1549 affects OpenSSL 1.1.1 by enabling the parent and child processes to share the same RNG state during a fork() system call, which poses a security risk.
What is the remediation for CVE-2019-1549?
To remediate CVE-2019-1549, update OpenSSL to version 1.1.1c or higher.
Where can I find more information about CVE-2019-1549?
You can find more information about CVE-2019-1549 in the OpenSSL security advisory and related references.