Security advisory

{
  "id": "275147f69780a1ff43bd83f8071389a039271a7ca46aa1350cc8bc946d997e44",
  "url": "https://osv.dev/vulnerability/CVE-2019-1549",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2019-1549",
    "summary": "OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).",
    "evidence": "osv:CVE-2019-1549",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2019-1549",
      "aliases": [
        "CVE-2019-1549"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/openssl/openssl",
              "type": "GIT",
              "events": [
                {
                  "introduced": "e04bd3433fd84e1861bf258ea37928d9845e6a86"
                },
                {
                  "last_affected": "e04bd3433fd84e1861bf258ea37928d9845e6a86"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "1.1.1"
                      },
                      {
                        "last_affected": "1.1.1c"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "OpenSSL_1_1_1w"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-1549.json"
          }
        }
      ],
      "modified": "2026-10-24T10:30:25.437481049Z",
      "provider": "osv",
      "references": [
        "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/",
        "https://seclists.org/bugtraq/2019/Oct/1",
        "https://support.f5.com/csp/article/K44070243",
        "https://support.f5.com/csp/article/K44070243?utm_source=f5support&amp%3Butm_medium=RSS",
        "https://usn.ubuntu.com/4376-1/",
        "https://www.oracle.com/security-alerts/cpuapr2020.html",
        "https://www.oracle.com/security-alerts/cpujan2020.html",
        "https://www.oracle.com/security-alerts/cpujul2020.html",
        "https://www.oracle.com/security-alerts/cpuoct2020.html",
        "https://security.netapp.com/advisory/ntap-20190919-0002/",
        "https://www.debian.org/security/2019/dsa-4539",
        "https://www.openssl.org/news/secadv/20190910.txt",
        "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2019-1549",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 431357,
  "published_at": "2019-09-10T17:15:11.813+00:00"
}