CVE-2019-1549: Fork Protection
OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSLinitcrypto() explicitly using OPENSSLINITATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jbcs-httpd24-aprto a version that resolves this vulnerability.Fixed in 0:1.6.3-86.jbcs.el6 - Upgrade
Upgrade
redhat/jbcs-httpd24-brotlito a version that resolves this vulnerability.Fixed in 0:1.0.6-21.jbcs.el6 - Upgrade
Upgrade
redhat/jbcs-httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.37-52.jbcs.el6 - Upgrade
Upgrade
redhat/jbcs-httpd24-opensslto a version that resolves this vulnerability.Fixed in 1:1.1.1c-16.jbcs.el6 - Upgrade
Upgrade
redhat/jbcs-httpd24-aprto a version that resolves this vulnerability.Fixed in 0:1.6.3-86.jbcs.el7 - Upgrade
Upgrade
redhat/jbcs-httpd24-brotlito a version that resolves this vulnerability.Fixed in 0:1.0.6-21.jbcs.el7 - Upgrade
Upgrade
redhat/jbcs-httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.37-52.jbcs.el7 - Upgrade
Upgrade
redhat/jbcs-httpd24-opensslto a version that resolves this vulnerability.Fixed in 1:1.1.1c-16.jbcs.el7 - Upgrade
Upgrade
redhat/opensslto a version that resolves this vulnerability.Fixed in 1:1.1.1c-15.el8 - Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 3.0.20-1~deb12u2Fixed in 3.0.22-1~deb12u2Fixed in 3.5.7-1~deb13u2Fixed in 3.5.7-1~deb13u3Fixed in 3.6.5-1 - Upgrade
Upgrade
alpine/opensslto a version that resolves this vulnerability.Fixed in 1.1.1d-r0 - Upgrade
Upgrade
alpine/opensslto a version that resolves this vulnerability.Fixed in 1.1.1d-r1 - Upgrade
Upgrade
alpine/openssl1.1-compatto a version that resolves this vulnerability.Fixed in 1.1.1d-r1 - Upgrade
Upgrade
alpine/openssl3to a version that resolves this vulnerability.Fixed in 1.1.1d-r1 - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 1.1.1d - Compensating control
Explicitly call OPENSSL_init_crypto() using OPENSSL_INIT_ATFORK to enable fork protection and prevent parent and child processes from sharing the same RNG state.
- Compensating control
Mix output from a high precision timer into the RNG state to significantly reduce the likelihood of a parent and child process sharing RNG state.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-1549?
CVE-2019-1549 is a vulnerability in OpenSSL 1.1.1 that affects the random number generator (RNG).
What is the severity of CVE-2019-1549?
CVE-2019-1549 has a severity rating of 5.3, which is considered medium.
How does CVE-2019-1549 affect OpenSSL?
CVE-2019-1549 affects OpenSSL 1.1.1 by enabling the parent and child processes to share the same RNG state during a fork() system call, which poses a security risk.
What is the remediation for CVE-2019-1549?
To remediate CVE-2019-1549, update OpenSSL to version 1.1.1c or higher.
Where can I find more information about CVE-2019-1549?
You can find more information about CVE-2019-1549 in the OpenSSL security advisory and related references.