Lucene search

FortinetCVE-2019-5592

HistoryAug 23, 2019 - 8:15 p.m.

CVE-2019-5592

2019-08-2320:15:10

CWE-347

fortinet

web.nvd.nist.gov

109

cve-2019-5592

padding oracle

zombie poodle

goldendoodle

openssl

cbc

fortios

ips

ssl deep inspection

man-in-the-middle

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

47.9%

JSON

Multiple padding oracle vulnerabilities (Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length) in the CBC padding implementation of FortiOS IPS engine version 5.000 to 5.006, 4.000 to 4.036, 4.200 to 4.219, 3.547 and below, when configured with SSL Deep Inspection policies and with the IPS sensor enabled, may allow an attacker to decipher TLS connections going through the FortiGate via monitoring the traffic in a Man-in-the-middle position.

Affected configurations

Nvd

Node

fortinetfortios_ips_engineRange≤3.00547

fortinetfortios_ips_engineRange4.00000–4.00036

fortinetfortios_ips_engineRange4.00200–4.00219

fortinetfortios_ips_engineRange5.00000–5.00006

VendorProductVersionCPE
fortinetfortios_ips_engine*cpe:2.3:a:fortinet:fortios_ips_engine:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortios_ips_engine	*	cpe:2.3:a:fortinet:fortios_ips_engine::::::::

CNA Affected

[
  {
    "product": "Fortinet IPS Engine",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "IPS engine version 5.000 to 5.006, 4.000 to 4.036, 4.200 to 4.219, 3.547 and below"
      }
    ]
  }
]

References

fortiguard.com/advisory/FG-IR-19-145

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

47.9%

JSON

Related for CVE-2019-5592