fkie_cve-2019-1563
Vulnerability from fkie_nvd
Published
2019-09-10 17:15
Modified
2024-11-21 04:36
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
References
openssl-security@openssl.orghttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html
openssl-security@openssl.orghttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html
openssl-security@openssl.orghttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html
openssl-security@openssl.orghttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html
openssl-security@openssl.orghttp://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html
openssl-security@openssl.orghttps://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=08229ad838c50f644d7e928e2eef147b4308ad64
openssl-security@openssl.orghttps://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=631f94db0065c78181ca9ba5546ebc8bb3884b97
openssl-security@openssl.orghttps://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f
openssl-security@openssl.orghttps://kc.mcafee.com/corporate/index?page=content&id=SB10365
openssl-security@openssl.orghttps://lists.debian.org/debian-lts-announce/2019/09/msg00026.html
openssl-security@openssl.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/
openssl-security@openssl.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/
openssl-security@openssl.orghttps://seclists.org/bugtraq/2019/Oct/0
openssl-security@openssl.orghttps://seclists.org/bugtraq/2019/Oct/1
openssl-security@openssl.orghttps://seclists.org/bugtraq/2019/Sep/25
openssl-security@openssl.orghttps://security.gentoo.org/glsa/201911-04
openssl-security@openssl.orghttps://security.netapp.com/advisory/ntap-20190919-0002/
openssl-security@openssl.orghttps://support.f5.com/csp/article/K97324400?utm_source=f5support&amp%3Butm_medium=RSS
openssl-security@openssl.orghttps://usn.ubuntu.com/4376-1/
openssl-security@openssl.orghttps://usn.ubuntu.com/4376-2/
openssl-security@openssl.orghttps://usn.ubuntu.com/4504-1/
openssl-security@openssl.orghttps://www.debian.org/security/2019/dsa-4539
openssl-security@openssl.orghttps://www.debian.org/security/2019/dsa-4540
openssl-security@openssl.orghttps://www.openssl.org/news/secadv/20190910.txtVendor Advisory
openssl-security@openssl.orghttps://www.oracle.com/security-alerts/cpuapr2020.html
openssl-security@openssl.orghttps://www.oracle.com/security-alerts/cpujan2020.html
openssl-security@openssl.orghttps://www.oracle.com/security-alerts/cpujul2020.html
openssl-security@openssl.orghttps://www.oracle.com/security-alerts/cpuoct2020.html
openssl-security@openssl.orghttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
openssl-security@openssl.orghttps://www.tenable.com/security/tns-2019-09
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html
af854a3a-2127-422b-91ae-364da2661108https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=08229ad838c50f644d7e928e2eef147b4308ad64
af854a3a-2127-422b-91ae-364da2661108https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=631f94db0065c78181ca9ba5546ebc8bb3884b97
af854a3a-2127-422b-91ae-364da2661108https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f
af854a3a-2127-422b-91ae-364da2661108https://kc.mcafee.com/corporate/index?page=content&id=SB10365
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/
af854a3a-2127-422b-91ae-364da2661108https://seclists.org/bugtraq/2019/Oct/0
af854a3a-2127-422b-91ae-364da2661108https://seclists.org/bugtraq/2019/Oct/1
af854a3a-2127-422b-91ae-364da2661108https://seclists.org/bugtraq/2019/Sep/25
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201911-04
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20190919-0002/
af854a3a-2127-422b-91ae-364da2661108https://support.f5.com/csp/article/K97324400?utm_source=f5support&amp%3Butm_medium=RSS
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4376-1/
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4376-2/
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4504-1/
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2019/dsa-4539
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2019/dsa-4540
af854a3a-2127-422b-91ae-364da2661108https://www.openssl.org/news/secadv/20190910.txtVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2020.html
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2020.html
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2020.html
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2020.html
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
af854a3a-2127-422b-91ae-364da2661108https://www.tenable.com/security/tns-2019-09
Impacted products
Vendor Product Version
openssl openssl *
openssl openssl *
openssl openssl *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "0DAC8B94-3674-4E4B-9BB0-A16CA0197885",
                     versionEndIncluding: "1.0.2s",
                     versionStartIncluding: "1.0.2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "65728FC6-4B4F-4D43-872B-BE1133BB2281",
                     versionEndIncluding: "1.1.0k",
                     versionStartIncluding: "1.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A2ACA227-3992-478E-85C3-023D8AF88A08",
                     versionEndIncluding: "1.1.1c",
                     versionStartIncluding: "1.1.1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).",
      },
      {
         lang: "es",
         value: "En situaciones donde un atacante recibe una notificación automática del éxito o el fracaso de un intento de descifrado, un atacante, luego de enviar una gran número de mensajes para descifrar, puede recuperar una clave de cifrado transportada de CMS/PKCS7 o descifrar cualquier mensaje cifrado de RSA que se cifró con la clave pública de RSA, utilizando un ataque de tipo padding oracle de Bleichenbacher. Las aplicaciones no están afectadas si usan un certificado junto con la clave RSA privada para las funciones CMS_decrypt o PKCS7_decrypt para seleccionar la información correcta del destinatario a descifrar. Corregido en OpenSSL versión 1.1.1d (afectada la versión 1.1.1-1.1.1c). Corregido en OpenSSL versión 1.1.0l (afectada la versión 1.1.0-1.1.0k). Corregido en OpenSSL versión 1.0.2t (afectada la versión 1.0.2-1.0.2s).",
      },
   ],
   id: "CVE-2019-1563",
   lastModified: "2024-11-21T04:36:49.310",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 3.7,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.2,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2019-09-10T17:15:11.890",
   references: [
      {
         source: "openssl-security@openssl.org",
         url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html",
      },
      {
         source: "openssl-security@openssl.org",
         url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html",
      },
      {
         source: "openssl-security@openssl.org",
         url: "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html",
      },
      {
         source: "openssl-security@openssl.org",
         url: "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html",
      },
      {
         source: "openssl-security@openssl.org",
         url: "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=08229ad838c50f644d7e928e2eef147b4308ad64",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=631f94db0065c78181ca9ba5546ebc8bb3884b97",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10365",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://seclists.org/bugtraq/2019/Oct/0",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://seclists.org/bugtraq/2019/Oct/1",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://seclists.org/bugtraq/2019/Sep/25",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://security.gentoo.org/glsa/201911-04",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://security.netapp.com/advisory/ntap-20190919-0002/",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://support.f5.com/csp/article/K97324400?utm_source=f5support&amp%3Butm_medium=RSS",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://usn.ubuntu.com/4376-1/",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://usn.ubuntu.com/4376-2/",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://usn.ubuntu.com/4504-1/",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://www.debian.org/security/2019/dsa-4539",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://www.debian.org/security/2019/dsa-4540",
      },
      {
         source: "openssl-security@openssl.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.openssl.org/news/secadv/20190910.txt",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://www.oracle.com/security-alerts/cpuapr2020.html",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://www.oracle.com/security-alerts/cpujan2020.html",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://www.oracle.com/security-alerts/cpujul2020.html",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://www.tenable.com/security/tns-2019-09",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=08229ad838c50f644d7e928e2eef147b4308ad64",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=631f94db0065c78181ca9ba5546ebc8bb3884b97",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10365",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://seclists.org/bugtraq/2019/Oct/0",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://seclists.org/bugtraq/2019/Oct/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://seclists.org/bugtraq/2019/Sep/25",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://security.gentoo.org/glsa/201911-04",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://security.netapp.com/advisory/ntap-20190919-0002/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://support.f5.com/csp/article/K97324400?utm_source=f5support&amp%3Butm_medium=RSS",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://usn.ubuntu.com/4376-1/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://usn.ubuntu.com/4376-2/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://usn.ubuntu.com/4504-1/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.debian.org/security/2019/dsa-4539",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.debian.org/security/2019/dsa-4540",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.openssl.org/news/secadv/20190910.txt",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.oracle.com/security-alerts/cpuapr2020.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.oracle.com/security-alerts/cpujan2020.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.oracle.com/security-alerts/cpujul2020.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.tenable.com/security/tns-2019-09",
      },
   ],
   sourceIdentifier: "openssl-security@openssl.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-203",
            },
            {
               lang: "en",
               value: "CWE-327",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.