CVE-2019-15605

Key facts

CVSS score

9.8 (v3.1)

Severity

CRITICAL

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness (CWE)

CWE-444

EPSS score

57.1% (99th percentile)

In CISA KEV

No

In EU EUVD

Yes (EUVD-2019-6565)

Published

February 7, 2020

NVD last modified

June 17, 2026

Status

Modified

Affected products

• debian / debian linux
• fedoraproject / fedora
• nodejs / node.js
• nodejs / node.js
• opensuse / leap
• oracle / graalvm
• oracle / graalvm
• redhat / enterprise linux
• redhat / enterprise linux desktop
• redhat / enterprise linux eus
• redhat / enterprise linux eus
• redhat / enterprise linux eus
• redhat / enterprise linux eus
• redhat / enterprise linux eus
• redhat / enterprise linux server
• redhat / enterprise linux server aus
• redhat / enterprise linux server aus
• redhat / enterprise linux server aus
• redhat / enterprise linux server aus
• redhat / enterprise linux server tus
• redhat / enterprise linux server tus
• redhat / enterprise linux server tus
• redhat / enterprise linux server tus
• redhat / enterprise linux workstation
• redhat / software collections

Certified products that may be affected

26 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

• Red Hat Enterprise Linux 8 NSS Cryptographic Module - Red Hat, Inc. - FIPS 140 5513 - active
• Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, LLC - FIPS 140 5461 - active
• Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5089 - active
• Red Hat Enterprise Linux 8.6 - Red Hat, Inc. - Common Criteria CCEVS-VR-VID-11309-2024 - archived
• Red Hat Enterprise Linux 8 OpenSSL Cryptographic Module - Red Hat®, Inc. - FIPS 140 4642 - historical

See all 26 in the Security Certifications Explorer.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html(Mailing List, Third Party Advisory)
• https://access.redhat.com/errata/RHSA-2020:0573(Third Party Advisory)
• https://access.redhat.com/errata/RHSA-2020:0579(Third Party Advisory)
• https://access.redhat.com/errata/RHSA-2020:0597(Third Party Advisory)
• https://access.redhat.com/errata/RHSA-2020:0598(Third Party Advisory)
• https://access.redhat.com/errata/RHSA-2020:0602(Third Party Advisory)
• https://access.redhat.com/errata/RHSA-2020:0703(Third Party Advisory)
• https://access.redhat.com/errata/RHSA-2020:0707(Third Party Advisory)
• https://access.redhat.com/errata/RHSA-2020:0708(Third Party Advisory)
• https://hackerone.com/reports/735748(Permissions Required, Third Party Advisory)
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CT3WTR4P5VAJ3GJGKPYEDUPTNZ3IEDUR/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLB676PDU4RJQLWQUA277YNGYYNEYGWO/
• https://nodejs.org/en/blog/release/v10.19.0/(Release Notes, Vendor Advisory)
• https://nodejs.org/en/blog/release/v12.15.0/(Release Notes, Vendor Advisory)
• https://nodejs.org/en/blog/release/v13.8.0/(Vendor Advisory)
• https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/(Vendor Advisory)
• https://security.gentoo.org/glsa/202003-48(Third Party Advisory)
• https://security.netapp.com/advisory/ntap-20200221-0004/(Third Party Advisory)
• https://www.debian.org/security/2020/dsa-4669(Third Party Advisory)
• https://www.oracle.com//security-alerts/cpujul2021.html(Patch, Third Party Advisory)
• https://www.oracle.com/security-alerts/cpuapr2020.html(Patch, Third Party Advisory)