--- id: CVE-2019-1563 title: >- In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption … summary: >- In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption … severity: low cvss: 3.7 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N' cwe: - CWE-203 - CWE-327 - CWE-200 vendor: openssl product: openssl affected: - 'openssl >= 1.0.2, <= 1.0.2s' - 'openssl >= 1.1.0, <= 1.1.0k' - 'openssl >= 1.1.1, <= 1.1.1c' published: '2019-09-10' updated: '2026-10-08' sourceUpdated: '2026-10-08T22:16:52.290' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-1563' references: - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html' label: openssl-security@openssl.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html' label: openssl-security@openssl.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html' label: openssl-security@openssl.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html' label: openssl-security@openssl.org - url: >- http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html label: openssl-security@openssl.org - url: >- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=08229ad838c50f644d7e928e2eef147b4308ad64 label: openssl-security@openssl.org - url: >- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=631f94db0065c78181ca9ba5546ebc8bb3884b97 label: openssl-security@openssl.org - url: >- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f label: openssl-security@openssl.org - url: 'https://kc.mcafee.com/corporate/index?page=content&id=SB10365' label: openssl-security@openssl.org - url: 'https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html' label: openssl-security@openssl.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/ label: openssl-security@openssl.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/ label: openssl-security@openssl.org - url: 'https://seclists.org/bugtraq/2019/Oct/0' label: openssl-security@openssl.org - url: 'https://seclists.org/bugtraq/2019/Oct/1' label: openssl-security@openssl.org - url: 'https://seclists.org/bugtraq/2019/Sep/25' label: openssl-security@openssl.org - url: 'https://security.gentoo.org/glsa/201911-04' label: openssl-security@openssl.org - url: 'https://security.netapp.com/advisory/ntap-20190919-0002/' label: openssl-security@openssl.org - url: >- https://support.f5.com/csp/article/K97324400?utm_source=f5support&%3Butm_medium=RSS label: openssl-security@openssl.org - url: 'https://usn.ubuntu.com/4376-1/' label: openssl-security@openssl.org - url: 'https://usn.ubuntu.com/4376-2/' label: openssl-security@openssl.org - url: 'https://usn.ubuntu.com/4504-1/' label: openssl-security@openssl.org - url: 'https://www.debian.org/security/2019/dsa-4539' label: openssl-security@openssl.org - url: 'https://www.debian.org/security/2019/dsa-4540' label: openssl-security@openssl.org - url: 'https://www.openssl.org/news/secadv/20190910.txt' label: openssl-security@openssl.org - url: 'https://www.oracle.com/security-alerts/cpuapr2020.html' label: openssl-security@openssl.org - url: 'https://www.oracle.com/security-alerts/cpujan2020.html' label: openssl-security@openssl.org - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: openssl-security@openssl.org - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: openssl-security@openssl.org - url: >- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html label: openssl-security@openssl.org - url: 'https://www.tenable.com/security/tns-2019-09' label: openssl-security@openssl.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=08229ad838c50f644d7e928e2eef147b4308ad64 label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=631f94db0065c78181ca9ba5546ebc8bb3884b97 label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://kc.mcafee.com/corporate/index?page=content&id=SB10365' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://seclists.org/bugtraq/2019/Oct/0' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://seclists.org/bugtraq/2019/Oct/1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://seclists.org/bugtraq/2019/Sep/25' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/201911-04' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20190919-0002/' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://support.f5.com/csp/article/K97324400?utm_source=f5support&%3Butm_medium=RSS label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4376-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4376-2/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4504-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2019/dsa-4539' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2019/dsa-4540' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.openssl.org/news/secadv/20190910.txt' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.tenable.com/security/tns-2019-09' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-1563.json - url: 'https://access.redhat.com/security/cve/CVE-2019-1563' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1752100' - url: 'https://www.cve.org/CVERecord?id=CVE-2019-1563' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-1563' - url: 'https://access.redhat.com/errata/RHSA-2020:1337' - url: 'https://access.redhat.com/errata/RHSA-2020:1840' - url: 'https://access.redhat.com/errata/RHSA-2020:1336' tags: - nvd - csaf - vex - red-hat - cve.org epss: 0.03838 epssPercentile: 0.90058 ingestedAt: '2026-10-08T23:16:47.299Z' patched: - jboss_core_services_on_rhel_6_server - jboss_core_services_on_rhel_7_server - enterprise_linux_baseos_v_8 - jboss_core_services_apache_http_server_2_4_37_sp2 ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-10-08T21:10:41.616859Z' --- ## Overview In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s). ## Affected - `openssl >= 1.0.2, <= 1.0.2s` - `openssl >= 1.1.0, <= 1.1.0k` - `openssl >= 1.1.1, <= 1.1.1c` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2020:1337** · Red Hat · fixed in: Red Hat JBoss Core Services on RHEL 6 Server, Red Hat JBoss Core Services on RHEL 7 Server · released 2020-04-06 · [advisory](https://access.redhat.com/errata/RHSA-2020:1337) - **RHSA-2020:1840** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8) · released 2020-04-28 · [advisory](https://access.redhat.com/errata/RHSA-2020:1840) - **RHSA-2020:1336** · Red Hat · fixed in: JBoss Core Services Apache HTTP Server 2.4.37 SP2 · released 2020-04-06 · [advisory](https://access.redhat.com/errata/RHSA-2020:1336) - **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat JBoss Enterprise Application Platform 5, Red Hat JBoss Enterprise Application Platform 6, … · no fix planned: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat JBoss Enterprise Application Platform 5, Red Hat JBoss Enterprise Application Platform 6, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-1563.json)