OpenSSL up to 1.1.1b ChaCha20-Poly1305 e_chacha20_poly1305.c cryptographic issues
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
6.4 | $0-$5k | 0.00 |
A vulnerability classified as critical has been found in OpenSSL up to 1.1.1b (Network Encryption Software). This affects an unknown functionality of the file crypto/evp/e_chacha20_poly1305.c of the component ChaCha20-Poly1305. The manipulation with an unknown input leads to a cryptographic issues vulnerability. CWE is classifying the issue as CWE-310. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1c-dev (Affected 1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k-dev (Affected 1.1.0-1.1.0j).
The bug was discovered 03/06/2019. The weakness was released 03/05/2019 as confirmed git commit (GIT Repository). It is possible to read the advisory at git.openssl.org. This vulnerability is uniquely identified as CVE-2019-1543 since 11/28/2018. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1600 according to MITRE ATT&CK. The reason for this vulnerability is this part of code:
if (arg <= 0 || arg > CHACHA_CTR_SIZE)The advisory points out:
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored.
The commercial vulnerability scanner Qualys is able to test this issue with plugin 172247 (OpenSUSE Security Update for openssl-1_1 (openSUSE-SU-2019:1147-1)). The advisory illustrates:
Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable.
Upgrading to version 1.1.0k-dev or 1.1.1c-dev eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.openssl.org. The best possible mitigation is suggested to be patching the affected component. A possible mitigation has been published 1 days after the disclosure of the vulnerability. The vulnerability will be addressed with the following lines of code:
if (arg <= 0 || arg > CHACHA20_POLY1305_MAX_IVLEN)
Entries connected to this vulnerability are available at 138172, 143680 and 153429.
Product
Type
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.5VulDB Meta Temp Score: 6.4
VulDB Base Score: 5.6
VulDB Temp Score: 5.4
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 7.4
NVD Vector: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Cryptographic issuesCWE: CWE-310
ATT&CK: T1600
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Upgrade: OpenSSL 1.1.0k-dev/1.1.1c-dev
Patch: ee22257b1418438ebaf54df98af4e24f494d1809
Timeline
11/28/2018 🔍03/05/2019 🔍
03/06/2019 🔍
03/06/2019 🔍
03/07/2019 🔍
07/29/2023 🔍
Sources
Product: openssl.orgAdvisory: RHSA-2019:3700
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2019-1543 (🔍)
SecurityFocus: 107349
See also: 🔍
Entry
Created: 03/07/2019 07:00Updated: 07/29/2023 08:27
Changes: 03/07/2019 07:00 (70), 05/14/2020 09:53 (2), 07/29/2023 08:24 (5), 07/29/2023 08:27 (1)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.