CVEvulnerability

CVE-2019-5592

5.9 MEDIUM Published 2019-08-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-08-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-347

Description

Multiple padding oracle vulnerabilities (Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length) in the CBC padding implementation of FortiOS IPS engine version 5.000 to 5.006, 4.000 to 4.036, 4.200 to 4.219, 3.547 and below, when configured with SSL Deep Inspection policies and with the IPS sensor enabled, may allow an attacker to decipher TLS connections going through the FortiGate via monitoring the traffic in a Man-in-the-middle position.

Affected configurations

• fortinet fortios ips engine (<= 3.00547) • fortinet fortios ips engine (>= 4.00000 <= 4.00036) • fortinet fortios ips engine (>= 4.00200 <= 4.00219) • fortinet fortios ips engine (>= 5.00000 <= 5.00006)

Related

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References