CVE-2019-1552

Published: 30 July 2019

OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and is configurable with the --prefix / --openssldir configuration options. For OpenSSL versions 1.1.0 and 1.1.1, the mingw configuration targets assume that resulting programs and libraries are installed in a Unix-like environment and the default prefix for program installation as well as for OPENSSLDIR should be '/usr/local'. However, mingw programs are Windows programs, and as such, find themselves looking at sub-directories of 'C:/usr/local', which may be world writable, which enables untrusted users to modify OpenSSL's default configuration, insert CA certificates, modify (or even replace) existing engine modules, etc. For OpenSSL 1.0.2, '/usr/local/ssl' is used as default for OPENSSLDIR on all Unix and Windows targets, including Visual C builds. However, some build instructions for the diverse Windows targets on 1.0.2 encourage you to specify your own --prefix. OpenSSL versions 1.1.1, 1.1.0 and 1.0.2 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

Notes

Author	Note
ebarretto	Windows specific

Priority

Cvss 3 Severity Score

3.3

Score breakdown

Status

Package	Release	Status
edk2 Launchpad, Ubuntu, Debian	bionic	Not vulnerable
	disco	Not vulnerable
	trusty	Does not exist
	upstream	Not vulnerable
	xenial	Not vulnerable
nodejs Launchpad, Ubuntu, Debian	bionic	Not vulnerable (uses system openssl1.0)
	disco	Not vulnerable (uses system openssl1.1)
	trusty	Not vulnerable (uses system openssl)
	upstream	Not vulnerable
	xenial	Not vulnerable (uses system openssl)
openssl Launchpad, Ubuntu, Debian	bionic	Not vulnerable
	disco	Not vulnerable
	trusty	Not vulnerable
	upstream	Not vulnerable (debian: Windows-specific)
	xenial	Not vulnerable
openssl1.0 Launchpad, Ubuntu, Debian	bionic	Not vulnerable
	disco	Does not exist
	trusty	Does not exist
	upstream	Not vulnerable (debian: Windows-specific)
	xenial	Does not exist

Severity score breakdown

Parameter	Value
Base score	3.3
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	Low
Availability impact	None
Vector	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›