Skip to page content

AEGLIX MIND

Intelligence for Africa and the Gulf

AEGLIX investigation

CVE-2019-1543 research

A source-linked research view connecting vulnerability evidence, reviewed campaign mentions, retained reporting and security tool listings.

Evidence summary

ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be lon...

Assess exposure and vendor guidance

  • No higher-priority signal is available in the current stored evidence.
  • Fresh EPSS data is unavailable; missing values are not zero.

CVSS: 7.4 · EPSS: Unavailable

Source retrieved 2026-11-02T19:30:14.594158+00:00. Read the full record and affected versions before making a patch decision.

Campaign content mentioning this CVE

Only published campaigns that passed the existing source-review gate are included. A textual mention does not establish exploitation or campaign membership.

No exact mention was found in the checked published campaign content.

Stored reporting mentioning this CVE

These are publisher excerpts, not independent verification of their claims.

No exact mention was found in the checked stored news excerpts.

Investigate advisory publishers

These domains come from vulnerability references. They are advisory publishers, not identified threat indicators. Links prefill Investigate; you choose whether to run a lookup.

Find referenced tools in Arsenal

Search published listings whose documented CVE-reference field contains CVE-2019-1543. An empty result is valid. A reference does not establish safety, exploit reliability or suitability for your environment.

Search exact CVE references in Arsenal

Review the listing’s source and trust evidence. Use testing tools only on systems you are authorized to assess.

Coverage and interpretation

Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence.

Checked up to 100 candidate excerpts and 100 candidate campaigns; at most 10 results per section are shown. No external search or scan ran while loading this page.

Open structured research evidence (JSON)