VDB
ALPINE-CVE-2019-1549
ALPINE-CVE-2019-1549
PUBLISHED
CVSS 5.300000190734863 MEDIUM
OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).
Risk Scores
CVSS v3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.18 | openssl | 0, 1.1.1-r1, 1.1.1-r2 |
| Alpine:v3.11 | openssl | *, 1.1.1, 1.1.1 |
| Alpine:v3.15 | openssl3 | 1.1.1, 0, 1.1.1-r3 |
| Alpine:v3.16 | openssl | 0, 0, 0 |
| Alpine:v3.13 | openssl | *, 1.1.1c-r0, 1.1.1c-r1 |
| Alpine:v3.9 | openssl | 1.1.1, 1.1.1, 1.1.1 |
| Alpine:v3.21 | openssl | 1.1.1-r0, 1.1.1-r0, 1.1.1-r1 |
| Alpine:v3.23 | openssl | 1.1.1b-r1, 1.1.1, 1.1.1 |
| Alpine:v3.17 | openssl | *, 1.1.1, 1.1.1 |
| Alpine:v3.16 | openssl3 | 1.1.1-r0, 0, 1.1.1-r0 |
| Alpine:v3.19 | openssl | *, 0, 1.1.1-r0 |
| Alpine:v3.10 | openssl | 1.1.1-r4, 0, 1.1.1-r1 |
| Alpine:v3.22 | openssl | 1.1.1a-r0, 1.1.1a-r1, 1.1.1b-r0 |
| Alpine:v3.15 | openssl | 0, 0, 0 |
| Alpine:v3.12 | openssl | 1.1.1-r4, 1.1.1-r5, 1.1.1a-r0 |
| Alpine:v3.14 | openssl | 1.1.1, 0, 1.1.1-r2 |
| Alpine:v3.20 | openssl | 1.1.1-r2, 1.1.1-r1, 1.1.1-r0 |
Timeline
- Sep 10, 2019 CVE Published
- Dec 3, 2025 CVE Updated
- Apr 30, 2026 Distribution Patch