CVE-2019-15606

Key facts

CVSS score

9.8 (v3.1)

Severity

CRITICAL

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness (CWE)

CWE-20

EPSS score

20.0% (97th percentile)

In CISA KEV

No

In EU EUVD

Yes (EUVD-2019-6566)

Published

February 7, 2020

NVD last modified

June 17, 2026

Status

Modified

Affected products

• debian / debian linux
• nodejs / node.js
• nodejs / node.js
• opensuse / leap
• oracle / communications cloud native core network function cloud native environment
• oracle / graalvm
• oracle / graalvm
• redhat / enterprise linux
• redhat / enterprise linux eus

Certified products that may be affected

24 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

• Red Hat Enterprise Linux 8 NSS Cryptographic Module - Red Hat, Inc. - FIPS 140 5513 - active
• Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, LLC - FIPS 140 5461 - active
• Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5089 - active
• Red Hat Enterprise Linux 8 OpenSSL Cryptographic Module - Red Hat®, Inc. - FIPS 140 4642 - historical
• Red Hat Enterprise Linux 8 NSS Cryptographic Module - Red Hat®, Inc. - FIPS 140 4458 - historical

See all 24 in the Security Certifications Explorer.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html(Mailing List, Third Party Advisory)
• https://access.redhat.com/errata/RHSA-2020:0573(Third Party Advisory)
• https://access.redhat.com/errata/RHSA-2020:0579(Third Party Advisory)
• https://access.redhat.com/errata/RHSA-2020:0597(Third Party Advisory)
• https://access.redhat.com/errata/RHSA-2020:0598(Third Party Advisory)
• https://access.redhat.com/errata/RHSA-2020:0602(Third Party Advisory)
• https://hackerone.com/reports/730779(Exploit, Third Party Advisory)
• https://nodejs.org/en/blog/release/v10.19.0/(Release Notes, Vendor Advisory)
• https://nodejs.org/en/blog/release/v12.15.0/(Release Notes, Vendor Advisory)
• https://nodejs.org/en/blog/release/v13.8.0/(Vendor Advisory)
• https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/(Vendor Advisory)
• https://security.gentoo.org/glsa/202003-48(Third Party Advisory)
• https://security.netapp.com/advisory/ntap-20200221-0004/(Third Party Advisory)
• https://www.debian.org/security/2020/dsa-4669(Third Party Advisory)
• https://www.oracle.com//security-alerts/cpujul2021.html(Third Party Advisory)
• https://www.oracle.com/security-alerts/cpuapr2020.html(Third Party Advisory)