cbcvebase.
CVE-2019-1563
published 2019-09-10

CVE-2019-1563: In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large…

PriorityP420low3.7CVSS 3.1
AVNACHPRNUINSUCLINAN
EPSS
3.84%
89.0th percentile
In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

Affected

16 ranges
VendorProductVersion rangeFixed in
debianopenssl< openssl 1.1.1d-1 (bookworm)openssl 1.1.1d-1 (bookworm)
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl>= 0 < 1.1.1d-11.1.1d-1
opensslopenssl>= 0 < 1.1.1d-11.1.1d-1
opensslopenssl>= 0 < 1.1.1d-11.1.1d-1
opensslopenssl>= 0 < 1.1.1d-11.1.1d-1
opensslopenssl>= 0 < 1.0.2g-1ubuntu4.161.0.2g-1ubuntu4.16
opensslopenssl>= 0 < 1.0.2g-1ubuntu4.171.0.2g-1ubuntu4.17
opensslopenssl>= 0 < 1.1.1-1ubuntu2.1~18.04.61.1.1-1ubuntu2.1~18.04.6
opensslopenssl>= 0 < 1.0.1f-1ubuntu2.27+esm11.0.1f-1ubuntu2.27+esm1
opensslopenssl1.0.2 – 1.0.2s
opensslopenssl1.1.0 – 1.1.0k
opensslopenssl1.1.1 – 1.1.1c
paloaltocortex_xdr

CVSS provenance

nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv4.7MEDIUM
vendor_ubuntu4.7MEDIUM
vendor_debian3.7LOW
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.