CVE-2019-1549 Fork Protection
OpenSSL's RNG fork protection failed by default, risking shared random states between parent and child processes, potentially compromising cryptographic keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-1549?
CVE-2019-1549 is a medium-severity vulnerability in Openssl Openssl, published on 10 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).
Weakness: CWE-330
Which versions are affected by CVE-2019-1549?
It affects 1 product.
Products include Openssl Openssl.
How do I fix CVE-2019-1549?
Upgrade to a fixed version.
Is CVE-2019-1549 being exploited?
There is no known exploitation of CVE-2019-1549 in the wild and no public exploit code.
Other vulnerabilities in Openssl Openssl
Sources
Also known as ALPINE-CVE-2019-1549, CLEANSTART-2026-WP77838, DEBIAN-CVE-2019-1549, GHSA-xmjp-8ccm-cf6h, JLSEC-2026-215, UBUNTU-CVE-2019-1549.