{"id":"CVE-2019-1563","title":"In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption …","summary":"In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption …","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-203","CWE-327","CWE-200"],"vendor":"openssl","product":"openssl","affected":["openssl >= 1.0.2, <= 1.0.2s","openssl >= 1.1.0, <= 1.1.0k","openssl >= 1.1.1, <= 1.1.1c"],"published":"2019-09-10","updated":"2026-10-08","sourceUpdated":"2026-10-08T22:16:52.290","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-1563","references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html","label":"openssl-security@openssl.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html","label":"openssl-security@openssl.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html","label":"openssl-security@openssl.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html","label":"openssl-security@openssl.org"},{"url":"http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html","label":"openssl-security@openssl.org"},{"url":"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=08229ad838c50f644d7e928e2eef147b4308ad64","label":"openssl-security@openssl.org"},{"url":"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=631f94db0065c78181ca9ba5546ebc8bb3884b97","label":"openssl-security@openssl.org"},{"url":"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f","label":"openssl-security@openssl.org"},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10365","label":"openssl-security@openssl.org"},{"url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html","label":"openssl-security@openssl.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/","label":"openssl-security@openssl.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/","label":"openssl-security@openssl.org"},{"url":"https://seclists.org/bugtraq/2019/Oct/0","label":"openssl-security@openssl.org"},{"url":"https://seclists.org/bugtraq/2019/Oct/1","label":"openssl-security@openssl.org"},{"url":"https://seclists.org/bugtraq/2019/Sep/25","label":"openssl-security@openssl.org"},{"url":"https://security.gentoo.org/glsa/201911-04","label":"openssl-security@openssl.org"},{"url":"https://security.netapp.com/advisory/ntap-20190919-0002/","label":"openssl-security@openssl.org"},{"url":"https://support.f5.com/csp/article/K97324400?utm_source=f5support&amp%3Butm_medium=RSS","label":"openssl-security@openssl.org"},{"url":"https://usn.ubuntu.com/4376-1/","label":"openssl-security@openssl.org"},{"url":"https://usn.ubuntu.com/4376-2/","label":"openssl-security@openssl.org"},{"url":"https://usn.ubuntu.com/4504-1/","label":"openssl-security@openssl.org"},{"url":"https://www.debian.org/security/2019/dsa-4539","label":"openssl-security@openssl.org"},{"url":"https://www.debian.org/security/2019/dsa-4540","label":"openssl-security@openssl.org"},{"url":"https://www.openssl.org/news/secadv/20190910.txt","label":"openssl-security@openssl.org"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","label":"openssl-security@openssl.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","label":"openssl-security@openssl.org"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","label":"openssl-security@openssl.org"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","label":"openssl-security@openssl.org"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","label":"openssl-security@openssl.org"},{"url":"https://www.tenable.com/security/tns-2019-09","label":"openssl-security@openssl.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=08229ad838c50f644d7e928e2eef147b4308ad64","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=631f94db0065c78181ca9ba5546ebc8bb3884b97","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10365","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://seclists.org/bugtraq/2019/Oct/0","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://seclists.org/bugtraq/2019/Oct/1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://seclists.org/bugtraq/2019/Sep/25","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201911-04","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20190919-0002/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.f5.com/csp/article/K97324400?utm_source=f5support&amp%3Butm_medium=RSS","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4376-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4376-2/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4504-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2019/dsa-4539","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2019/dsa-4540","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.openssl.org/news/secadv/20190910.txt","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.tenable.com/security/tns-2019-09","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-1563.json"},{"url":"https://access.redhat.com/security/cve/CVE-2019-1563"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1752100"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1563"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1563"},{"url":"https://access.redhat.com/errata/RHSA-2020:1337"},{"url":"https://access.redhat.com/errata/RHSA-2020:1840"},{"url":"https://access.redhat.com/errata/RHSA-2020:1336"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.03838,"epssPercentile":0.90058,"ingestedAt":"2026-10-08T23:16:47.299Z","patched":["jboss_core_services_on_rhel_6_server","jboss_core_services_on_rhel_7_server","enterprise_linux_baseos_v_8","jboss_core_services_apache_http_server_2_4_37_sp2"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-08T21:10:41.616859Z"},"slug":"CVE-2019-1563","body":"## Overview\n\nIn situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).\n\n## Affected\n\n- `openssl >= 1.0.2, <= 1.0.2s`\n- `openssl >= 1.1.0, <= 1.1.0k`\n- `openssl >= 1.1.1, <= 1.1.1c`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2020:1337** · Red Hat · fixed in: Red Hat JBoss Core Services on RHEL 6 Server, Red Hat JBoss Core Services on RHEL 7 Server · released 2020-04-06 · [advisory](https://access.redhat.com/errata/RHSA-2020:1337)\n- **RHSA-2020:1840** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8) · released 2020-04-28 · [advisory](https://access.redhat.com/errata/RHSA-2020:1840)\n- **RHSA-2020:1336** · Red Hat · fixed in: JBoss Core Services Apache HTTP Server 2.4.37 SP2 · released 2020-04-06 · [advisory](https://access.redhat.com/errata/RHSA-2020:1336)\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat JBoss Enterprise Application Platform 5, Red Hat JBoss Enterprise Application Platform 6, … · no fix planned: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat JBoss Enterprise Application Platform 5, Red Hat JBoss Enterprise Application Platform 6, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-1563.json)","depth":"sunlit","depthScore":21,"depthScoreParts":{"impact":20.4,"likelihood":0.8,"exploitation":0,"ransomware":0},"changes":[]}