{"id":"CVE-2019-1549","aliases":["ALPINE-CVE-2019-1549","BELL-CVE-2019-1549","DEBIAN-CVE-2019-1549","EUVD-2019-10106","GHSA-xmjp-8ccm-cf6h","JLSEC-2026-215","RHSA-2020:1337","RHSA-2020:1840","SUSE-SU-2020:0099-1","UBUNTU-CVE-2019-1549","USN-4376-1","openSUSE-SU-2024:11127-1"],"status":"published","title":"Fork Protection","description":"OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.06182,"percentile":0.93585,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-330"],"published":"2019-09-10T16:58:35Z","modified":"2026-11-03T06:32:29Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"openssl","fixed_in":["1.1.1d-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"openssl","fixed_in":["1.1.1d-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"openssl","fixed_in":["1.1.1d-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"openssl","fixed_in":["1.1.1d-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"openssl","fixed_in":["1.1.1d-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"openssl","fixed_in":["1.1.1d-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"openssl","fixed_in":["1.1.1d-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openssl","fixed_in":["1.1.1d-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openssl","fixed_in":["1.1.1d-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openssl","fixed_in":["1.1.1d-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openssl","fixed_in":["1.1.1d-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openssl","fixed_in":["1.1.1d-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssl","fixed_in":["1.1.1d-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssl","fixed_in":["1.1.1d-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssl","fixed_in":["1.1.1d-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"openssl","fixed_in":["1.1.1d-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openssl1.1-compat","fixed_in":["1.1.1d-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openssl1.1-compat","fixed_in":["1.1.1d-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"openssl3","fixed_in":["1.1.1d-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"openssl3","fixed_in":["1.1.1d-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openssl","fixed_in":["1.1.1d-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssl","fixed_in":["1.1.1d-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssl","fixed_in":["1.1.1d-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"OpenSSL_jll","fixed_in":["1.1.1+2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"openssl","fixed_in":["1.1.1-1ubuntu2.1~18.04.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1"},{"fixed":"1.1.1d-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1"},{"fixed":"1.1.1d-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1"},{"fixed":"1.1.1d-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1"},{"fixed":"1.1.1d-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1"},{"fixed":"1.1.1d-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1"},{"fixed":"1.1.1d-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1"},{"fixed":"1.1.1d-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1"},{"fixed":"1.1.1d-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1"},{"fixed":"1.1.1d-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1"},{"fixed":"1.1.1d-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1"},{"fixed":"1.1.1d-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1"},{"fixed":"1.1.1d-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1"},{"fixed":"1.1.1d-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1"},{"fixed":"1.1.1d-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1"},{"fixed":"1.1.1d-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1"},{"fixed":"1.1.1d-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openssl1.1-compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openssl1.1-compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"openssl3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openssl3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"OpenSSL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.1+2"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-86.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-apr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-86.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-apr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-86.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-21.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-brotli-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-21.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-brotli-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-21.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-52.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-52.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-52.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-52.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-52.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-52.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_cluster-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.12-41.Final_redhat_2.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_cluster-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.12-41.Final_redhat_2.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.3-22.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.3-22.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-52.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-52.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-52.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-52.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-16.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-16.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-16.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-16.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-16.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-16.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-86.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-86.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-86.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-21.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-brotli-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-21.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-brotli-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-21.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-52.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-52.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-52.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-52.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-52.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-52.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_cluster-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.12-41.Final_redhat_2.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_cluster-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.12-41.Final_redhat_2.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.3-22.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.3-22.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-52.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-52.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-52.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-52.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-16.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-16.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-16.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-16.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-16.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-16.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1c-15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-2.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-2.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-2.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-2.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-2.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-2.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-2.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.6"}]}],"versions":["1.0.2g-1ubuntu13","1.0.2g-1ubuntu14","1.0.2n-1ubuntu1","1.1.0g-2ubuntu1","1.1.0g-2ubuntu2","1.1.0g-2ubuntu3","1.1.0g-2ubuntu4","1.1.0g-2ubuntu4.1","1.1.0g-2ubuntu4.3","1.1.1-1ubuntu2.1~18.04.1","1.1.1-1ubuntu2.1~18.04.2","1.1.1-1ubuntu2.1~18.04.3","1.1.1-1ubuntu2.1~18.04.4","1.1.1-1ubuntu2.1~18.04.5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.16"}]}],"versions":["1.0.2d-0ubuntu1","1.0.2d-0ubuntu2","1.0.2e-1ubuntu1","1.0.2f-2ubuntu1","1.0.2g-1ubuntu2","1.0.2g-1ubuntu3","1.0.2g-1ubuntu4","1.0.2g-1ubuntu4.1","1.0.2g-1ubuntu4.2","1.0.2g-1ubuntu4.4","1.0.2g-1ubuntu4.5","1.0.2g-1ubuntu4.6","1.0.2g-1ubuntu4.8","1.0.2g-1ubuntu4.9","1.0.2g-1ubuntu4.10","1.0.2g-1ubuntu4.11","1.0.2g-1ubuntu4.12","1.0.2g-1ubuntu4.13","1.0.2g-1ubuntu4.14","1.0.2g-1ubuntu4.15"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.6"}]}],"versions":["1.0.2g-1ubuntu13","1.0.2g-1ubuntu14","1.0.2n-1ubuntu1","1.1.0g-2ubuntu1","1.1.0g-2ubuntu2","1.1.0g-2ubuntu3","1.1.0g-2ubuntu4","1.1.0g-2ubuntu4.1","1.1.0g-2ubuntu4.3","1.1.1-1ubuntu2.1~18.04.1","1.1.1-1ubuntu2.1~18.04.2","1.1.1-1ubuntu2.1~18.04.3","1.1.1-1ubuntu2.1~18.04.4","1.1.1-1ubuntu2.1~18.04.5"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-1.2"}]}],"bundled":136}],"products":[{"vendor":"openssl","product":"openssl"}],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://seclists.org/bugtraq/2019/Oct/1","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"https://www.debian.org/security/2019/dsa-4539","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://usn.ubuntu.com/4376-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC","x_transferred","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.openssl.org/news/secadv/20190910.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20190919-0002/","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://support.f5.com/csp/article/K44070243","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://support.f5.com/csp/article/K44070243?utm_source=f5support\u0026amp%3Butm_medium=RSS","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1549","tags":["web","advisory"]},{"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be","tags":["web"]},{"url":"https://support.f5.com/csp/article/K44070243?utm_source=f5support\u0026amp;utm_medium=RSS","tags":["web"]},{"url":"https://usn.ubuntu.com/4376-1","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20190919-0002","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xmjp-8ccm-cf6h","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-1549","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-1549","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-1549","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1337","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1743956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1743959","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1743966","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1743974","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1743996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1752090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1752095","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1752100","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1820761","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1337.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1547","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1547","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1547","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1549","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1549","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1563","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1563","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1563","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10081","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10081","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10081","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10082","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10082","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10082","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10092","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10092","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10092","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10097","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10097","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10098","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10098","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10098","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-1927","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-1927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1927","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1840","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1735738","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1741285","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1741317","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1741641","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1749068","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1749790","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1758587","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1793984","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1840.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200099-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1133925","tags":["report"]},{"url":"https://bugzilla.suse.com/1140277","tags":["report"]},{"url":"https://bugzilla.suse.com/1150003","tags":["report"]},{"url":"https://bugzilla.suse.com/1150247","tags":["report"]},{"url":"https://bugzilla.suse.com/1150250","tags":["report"]},{"url":"https://bugzilla.suse.com/1158809","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1563","tags":["web"]},{"url":"https://bugzilla.suse.com/SLE-6430","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-1549","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4376-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-1547","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-1551","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-1563","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-2937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-2940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-3738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-4339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-4343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-7250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-5298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0734","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3712","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-1549","title":"Fork Protection","description":"OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).","status":"published","published":"2019-09-10T16:58:35.361Z","modified":"2024-09-16T22:56:57.501Z","updated_at":"2026-11-02T14:20:25.661187Z"}],"euvd":[{"id":"EUVD-2019-10106","description":"OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).","status":"published","published":"2019-09-10T16:58:35Z","modified":"2024-09-16T22:56:57Z","updated_at":"2026-11-03T00:54:58.273879Z"}],"ghsa":[{"id":"GHSA-xmjp-8ccm-cf6h","title":"OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include...","description":"OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).","status":"published","published":"2022-05-24T16:55:53Z","modified":"2024-04-04T01:55:03Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:56:03.89673Z"}],"nvd":[{"id":"CVE-2019-1549","description":"OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).","status":"published","published":"2019-09-10T17:15:11.813Z","modified":"2026-06-17T02:28:43.74Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:05:25.691233Z"}],"osv":[{"id":"ALPINE-CVE-2019-1549","description":"OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).","status":"published","published":"2019-09-10T17:15:11.813Z","modified":"2026-11-03T06:32:29.554938183Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"BELL-CVE-2019-1549","title":"CVE-2019-1549 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:18.248651Z","modified":"2026-01-26T09:46:11.041054Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-1549","description":"OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).","status":"published","published":"2019-09-10T17:15:11.813Z","modified":"2026-11-11T10:45:18.912885001Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-11T11:06:15.895905Z"},{"id":"DEBIAN-CVE-2019-1549","description":"OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).","status":"published","published":"2019-09-10T17:15:11.813Z","modified":"2026-09-21T07:01:11.27769917Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"JLSEC-2026-215","title":"OpenSSL 1.1.1 introduced a rewritten random number generator (RNG)","description":"OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls `OPENSSL_init_crypto()` explicitly using `OPENSSL_INIT_ATFORK` then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).","status":"published","published":"2026-04-27T18:33:55.942Z","modified":"2026-07-25T18:23:48.865868495Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"RHSA-2020:1337","title":"Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 security update","status":"published","published":"2024-10-01T17:13:13Z","modified":"2026-09-21T10:02:33Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:1840","title":"Red Hat Security Advisory: openssl security and bug fix update","status":"published","published":"2024-10-01T17:13:30Z","modified":"2026-09-21T10:02:36Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"UBUNTU-CVE-2019-1549","description":"OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).","status":"published","published":"2019-09-10T17:15:00Z","modified":"2026-04-22T12:11:35.510975Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"openSUSE-SU-2024:11127-1","title":"libopenssl-1_1-devel-1.1.1l-1.2 on GA media","description":"These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:19.520287Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2020:0099-1","title":"Security update for openssl-1_1","description":"This update for openssl-1_1 fixes the following issues:\n\nSecurity issue fixed:                                                                                      \n                                                                                                                                                                         \n- CVE-2019-1551: Fixed an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli (bsc#1158809). \n- CVE-2019-1563: Fixed bleichenbacher attack against cms/pkcs7 encryptioon transported key (bsc#1150250).\n- CVE-2019-1551: Fixed integer overflow in RSAZ modular exponentiation on x86_64 (bsc#1158809).\n- CVE-2019-1549: Fixed fork problem with random generator (bsc#1150247).\n- CVE-2019-1547: Fixed EC_GROUP_set_generator side channel attack avoidance (bsc#1150003).\n\nBug fixes:\n\n- Ship the openssl 1.1.1 binary as openssl-1_1, and make it installable in parallel with the system openssl (bsc#1140277).\n- Update to 1.1.1d (bsc#1133925, jsc#SLE-6430).\n","status":"published","published":"2020-01-14T14:17:24Z","modified":"2026-02-04T02:48:20.134725Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-4376-1","title":"openssl vulnerabilities","description":"Cesar Pereida García, Sohaib ul Hassan, Nicola Tuveri, Iaroslav Gridin,\nAlejandro Cabrera Aldaya, and Billy Brumley discovered that OpenSSL\nincorrectly handled ECDSA signatures. An attacker could possibly use this\nissue to perform a timing side-channel attack and recover private ECDSA\nkeys. (CVE-2019-1547)\n\nMatt Caswell discovered that OpenSSL incorrectly handled the random number\ngenerator (RNG). This may result in applications that use the fork() system\ncall sharing the same RNG state between the parent and the child, contrary\nto expectations. This issue only affected Ubuntu 18.04 LTS and Ubuntu\n19.10. (CVE-2019-1549)\n\nGuido Vranken discovered that OpenSSL incorrectly performed the x86_64\nMontgomery squaring procedure. While unlikely, a remote attacker could\npossibly use this issue to recover private keys. (CVE-2019-1551)\n\nBernd Edlinger discovered that OpenSSL incorrectly handled certain\ndecryption functions. In certain scenarios, a remote attacker could\npossibly use this issue to perform a padding oracle attack and decrypt\ntraffic. (CVE-2019-1563)\n","status":"published","published":"2020-05-28T12:07:08Z","modified":"2026-04-27T15:48:45.415111723Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}