-4

"OpenSSL 0-Length" how to fix this?

closed as unclear what you're asking by Rui F Ribeiro, muru, Stephen Kitt, Sparhawk, dr01 Jun 14 at 9:41

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    I think you will have to expand on your question a bit to give it a bit more context. See e.g. unix.stackexchange.com/help/how-to-ask – Kusalananda Jun 14 at 6:20
  • 2
    Probably a reference to CVE-2019-1559 (Qualys SSL Labs scanner identifies it by that name.) This probably means you need to update your OpenSSL. Probably. – Gordon Davisson Jun 14 at 6:26
  • 1
    I find it quite odd the tool does not mention the CVE/explains what this is about and often also remediation steps. It would also be useful having the name of the tool, distribution of Linux, openssl packages and respective versions. The question in present form is too vague and presents unnecessary guess work for whoever tries to answer it due for time not being invested in asking a more complete question. – Rui F Ribeiro Jun 14 at 7:47
  • I simply assumed the poster might not know what a CVE number is, and so has not understood its significance. So I wrote my answer below as a quick universal primer on "what to do if you're told that you have <some specific vulnerability>". – telcoM Jun 15 at 8:06
4

First, you find out the CVE number for this vulnerability. A quick bit of Googling tells me "OpenSSL 0-length" is CVE-2019-1559, published in February of this year.

Any enterprise-grade Linux distribution (or any other OS for that matter) should have a list of security patches/announcements by CVE numbers, or some other way to find out which security patches fix a vulnerability identified by a particular CVE.

There are also vendor-neutral vulnerability databases, like this one for example. They often include links to vendor-specific security announcements: find the announcement applicable to your distribution, and you'll have the exact information you need to fix the vulnerability in a maintainable way.

Vulnerability databases also include short descriptions of the nature of the vulnerability, if you need that: in this case, OpenSSL responds differently to different types of errors in received encrypted traffic, and if the attacker can detect this difference, it can be abused to decrypt encrypted data under some specific conditions.

From the description, you might guess that there could be two possible ways to fix this vulnerability: 1.) patch OpenSSL to have an uniform response to all decryption errors, or 2.) patch all OpenSSL-using applications to not disclose the type of decryption error to a possible attacker. Both are obviously desirable, but 1) provides a quick solution for many applications at once, and so it is likely to be the primary fix.

The vulnerability database also indicates that the vulnerability exists in OpenSSL versions starting from version 1.0.2 to version 1.0.2q. So you'll want to install an update for your OS that includes either OpenSSL 1.0.2r or greater, or any version of OpenSSL 1.0.2 that specifically says it includes a backported fix for CVE-2019-1559.

  • It could be also a false positive, which is a common occurrence with those kind of tools. But then the question is too vague, and I do believe it is borderline off topic here. We are more Unix oriented than deciphering the output of random tools. I also find it strange the tool only giving that output, usually they provide at least CVE link. This answer is making the best with the information available. +1 – Rui F Ribeiro Jun 14 at 7:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.