Padding oracle attack in OpenSSL - CVE-2019-1563

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU21045

Padding oracle attack in OpenSSL - CVE-2019-1563

Published: September 11, 2019


Vulnerability identifier: #VU21045
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-1563
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform padding oracle attack.

The vulnerability exists due to possibility to perform a Bleichenbacher padding oracle attack against the RSA key, in situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker. A remote attacker can send a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key.


Affected software

OpenSSL
JBoss Core Services
Amazon Linux AMI
Gentoo Linux
Fedora
IBM AIX
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Ubuntu
Slackware Linux
Opensuse
Tenable.sc
openssl (Alpine package)
openssl1.0 (Debian package)
openssl (Ubuntu package)
jbcs-httpd24-brotli (Red Hat package)
openssl (Debian package)
jbcs-httpd24-apr (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-httpd (Red Hat package)
libssl1.0.0 (Ubuntu package)
openssl11
openssl (Red Hat package)
openssl
APM Edge
Watson Speech to Text, Text to Speech
EMC ECS
IBM Qradar SIEM
IBM PureData System for Operational Analytics
NetWorker
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
EMC Data Domain

How to mitigate CVE-2019-1563

Install updates from vendor's website.

OpenSSL - addressed in versions 1.0.2t, 1.1.0l, 1.1.1d
Tenable.sc - update to 5.13.0
APM Edge - update to 4.0
openssl (Alpine package) - addressed in versions 1.0.2t-r0, 1.1.1d-r0
openssl1.0 (Debian package) - update to 1.0.2t-1~deb9u1
openssl (Ubuntu package) - addressed in versions 1.0.2g-1ubuntu4.16, 1.1.1c-1ubuntu4.1, 1.1.1-1ubuntu2.1~18.04.6
jbcs-httpd24-brotli (Red Hat package) - addressed in versions 1.0.6-21.jbcs.el6, 1.0.6-21.jbcs.el7
openssl (Debian package) - addressed in versions 1.1.0l-1~deb9u1, 1.1.1d-0+deb10u1
jbcs-httpd24-apr (Red Hat package) - addressed in versions 1.6.3-86.jbcs.el6, 1.6.3-86.jbcs.el7
jbcs-httpd24-mod_http2 (Red Hat package) - addressed in versions 1.11.3-22.jbcs.el6, 1.11.3-22.jbcs.el7
jbcs-httpd24-httpd (Red Hat package) - addressed in versions 2.4.37-52.jbcs.el6, 2.4.37-52.jbcs.el7
IBM Qradar SIEM - update to 7.5.0 Update Pack 8
libssl1.0.0 (Ubuntu package) - addressed in versions 1.0.1f-1ubuntu2.27+esm1, 1.0.1-4ubuntu5.44, 1.0.2g-1ubuntu4.17, 1.0.2n-1ubuntu5.4
IBM PureData System for Operational Analytics - update to 1.1 FP5
openssl11 - update to 1.1.1c-2.el7
openssl (Red Hat package) - update to 1.1.1c-15.el8
openssl - addressed in versions 1.1.1d-1.fc29, 1.1.1d-1.fc30, 1.1.1d-1.fc31
Watson Speech to Text, Text to Speech - update to 1.1.2
EMC ECS - update to 3.5.0.1
Dell EMC Unity Operating Environment (OE) - update to 5.0.3.0.5.014
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.3.0.5.014
EMC Data Domain - addressed in versions 6.1.2.70, 6.2.1.0, 7.0.0.20
NetWorker - update to 19.10.0.0

External References

Related Security Bulletins