CVE-2019-1552

CVE-2019-1552 describes a low-severity vulnerability in OpenSSL versions 1.0.2, 1.1.0, and 1.1.1, specifically impacting Windows builds (mingw and Visual C). The issue stems from OpenSSL's default configuration directory (OPENSSLDIR) being set to a Unix-like path (e.g., '/usr/local') even on Windows, leading to programs looking in 'C:/usr/local'. This directory can be world-writable, allowing untrusted users to modify OpenSSL's configuration, insert malicious CA certificates, or replace engine modules. The CVSS score is 3.3 (LOW), indicating a local attack vector with low complexity, requiring low privileges, and resulting in low integrity impact (e.g., unauthorized modification of configuration). There is no confidentiality or availability impact. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness and attention.