Attacker Value

Unknown

(0 users assessed)

Exploitability

Unknown

(0 users assessed)

User Interaction

None

Privileges Required

None

Attack Vector

Network

0

CVE-2019-1563

Disclosure Date: September 10, 2019 •

CVE-2019-1563 CVSS v3 Base Score: 3.7

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

3.7 Low

Impact Score:

1.4

Exploitability Score:

2.2

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector (AV):

Network

Attack Complexity (AC):

High

Privileges Required (PR):

None

User Interaction (UI):

None

Scope (S):

Unchanged

Confidentiality (C):

Low

Integrity (I):

None

Availability (A):

None

Vendors

openssl

Products

openssl

References

Canonical

CVE-2019-1563 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563)

Advisory

20190912 [slackware-security] openssl (SSA:2019-254-03) (https://seclists.org/bugtraq/2019/Sep/25)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html

FEDORA-2019-d15aac6c4e (https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html

[debian-lts-announce] 20190925 [SECURITY] [DLA 1932-1] openssl security update (https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html)

FEDORA-2019-d51641f152 (https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E)

20191001 [SECURITY] [DSA 4539-1] openssl security update (https://seclists.org/bugtraq/2019/Oct/1)

20191001 [SECURITY] [DSA 4540-1] openssl1.0 security update (https://seclists.org/bugtraq/2019/Oct/0)

DSA-4539 (https://www.debian.org/security/2019/dsa-4539)

DSA-4540 (https://www.debian.org/security/2019/dsa-4540)

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html

GLSA-201911-04 (https://security.gentoo.org/glsa/201911-04)

USN-4376-1 (https://usn.ubuntu.com/4376-1)

https://www.openssl.org/news/secadv/20190910.txt

https://security.netapp.com/advisory/ntap-20190919-0002

https://www.tenable.com/security/tns-2019-09

https://git.openssl.org/gitweb?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64

https://git.openssl.org/gitweb?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97

https://git.openssl.org/gitweb?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f

https://support.f5.com/csp/article/K97324400?utm_source=f5support&utm_medium=RSS

USN-4376-2 (https://usn.ubuntu.com/4376-2)

USN-4504-1 (https://usn.ubuntu.com/4504-1)

FEDORA-2019-d15aac6c4e (https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/)

FEDORA-2019-d51641f152 (https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/)

USN-4376-1 (https://usn.ubuntu.com/4376-1/)

https://security.netapp.com/advisory/ntap-20190919-0002/

https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64

https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97

https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f

USN-4376-2 (https://usn.ubuntu.com/4376-2/)

USN-4504-1 (https://usn.ubuntu.com/4504-1/)

https://kc.mcafee.com/corporate/index?page=content&id=SB10365

Miscellaneous

https://www.oracle.com/security-alerts/cpuapr2020.html

https://www.oracle.com/security-alerts/cpujul2020.html

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

https://www.oracle.com/security-alerts/cpujan2020.html

http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html

https://www.oracle.com/security-alerts/cpuoct2020.html

Rapid7

Technical Analysis