CVE-2019-5592 - Multiple padding oracle vulnerabilities (Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length) in the CBC padding implementation of FortiOS IPS engine version 5.000 to 5.006, 4.000 to 4.036, 4.200 to 4.219, 3.547 and below, when configured with SSL Deep Inspection policies and with the IPS sensor enabled, may allow an attacker to decipher TLS connections going through the FortiGate via monitoring the traffic in a Man-in-the-middle position

Back Back to CVE browser

MEDIUM

Multiple padding oracle vulnerabilities (Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length) in the CBC padding implementation of FortiOS IPS engine version 5.000 to 5.006, 4.000 to 4.036, 4.200 to 4.219, 3.547 and below, when configured with SSL Deep Inspection policies and with the IPS sensor enabled, may allow an attacker to decipher TLS connections going through the FortiGate via monitoring the traffic in a Man-in-the-middle position

Published Aug 23, 2019

5.9

MEDIUM

CVSS 3.1

EPSS 0.71%

Description

Multiple padding oracle vulnerabilities (Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length) in the CBC padding implementation of FortiOS IPS engine version 5.000 to 5.006, 4.000 to 4.036, 4.200 to 4.219, 3.547 and below, when configured with SSL Deep Inspection policies and with the IPS sensor enabled, may allow an attacker to decipher TLS connections going through the FortiGate via monitoring the traffic in a Man-in-the-middle position.

Affected products

Vendor n/a Product Fortinet IPS Engine Default
n/a
- Version
  IPS engine version 5.000 to 5.006, 4.000 to 4.036, 4.200 to 4.219, 3.547 and below
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Fortinet IPS Engine

n/a

Version	Status	Constraints
IPS engine version 5.000 to 5.006, 4.000 to 4.036, 4.200 to 4.219, 3.547 and below	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-347

References (1)

https://fortiguard.com/advisory/FG-IR-19-145
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://fortiguard.com/advisory/FG-IR-19-145		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner fortinet

Published Aug 23, 2019

Updated Oct 25, 2024

Reserved Jan 7, 2019

Link CVE-2019-5592

CISA Vulnrichment

Updated Oct 23, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-5592

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-5592