Düşük CVSS 3.7
CVE-2019-1563: Openssl: güvenlik açığı
Açıklama (NVD)
In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
Özet bilgiler
- Ürün
- Openssl Openssl
- CVSS v3.1
- 3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - EPSS
- %3,84 (yüzdelik 90)
- CWE
- CWE-203
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| openssl-openssl | 1.0.2 | 1.0.2s | — |
| openssl-openssl | 1.1.0 | 1.1.0k | — |
| openssl-openssl | 1.1.1 | 1.1.1c | — |
Kaynaklar
- NVD kaydı
- lists.opensuse.org
- lists.opensuse.org
- lists.opensuse.org
- lists.opensuse.org
- packetstormsecurity.com
- git.openssl.org
- git.openssl.org
- git.openssl.org
- kc.mcafee.com
- lists.debian.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- seclists.org
- seclists.org
- seclists.org
- security.gentoo.org
- security.netapp.com
- support.f5.com
- usn.ubuntu.com
- usn.ubuntu.com
- usn.ubuntu.com
- www.debian.org
- www.debian.org
- www.openssl.org
- CWE-203