In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
CVSS Details
- CVSS 3.1 Base Score: 3.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade opensslUpgrade openssl1.1-compatUpgrade openssl3 | Dec 27, 2019 | Sep 10, 2019 |
| Amazon Linux Ami 2 | — | Upgrade openssl11-debuginfoUpgrade openssl11-develUpgrade openssl-debuginfoUpgrade openssl-perlUpgrade openssl-libsUpgrade opensslUpgrade openssl-staticUpgrade openssl11-libsUpgrade openssl11-staticUpgrade openssl-develUpgrade openssl11 | Apr 27, 2020 | Sep 10, 2019 |
| Amazon_linux | — | Upgrade openssl | Mar 2, 2020 | Sep 10, 2019 |
| Centos_linux | — | Upgrade openssl-debuginfoUpgrade openssl-libsUpgrade openssl-debugsourceUpgrade openssl-develUpgrade openssl-libs-debuginfoUpgrade opensslUpgrade openssl-perl | Apr 29, 2020 | Sep 10, 2019 |
| Debian | — | Upgrade openssl | Sep 27, 2019 | Sep 10, 2019 |
| Gentoo Linux | — | Upgrade dev-libs/openssl. | Nov 8, 2019 | Sep 10, 2019 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Sep 12, 2019 | Sep 10, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade openssl-libsUpgrade openssl-develUpgrade openssl | Dec 4, 2019 | Sep 10, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade openssl-libsUpgrade opensslUpgrade openssl-devel | Nov 19, 2019 | Sep 10, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade openssl110h-staticUpgrade openssl110hUpgrade openssl110h-develUpgrade openssl110h-libs | Nov 19, 2019 | Sep 10, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade compat-openssl10 | Nov 19, 2019 | Sep 10, 2019 |
| Huawei Euleros 2_0_sp9 | — | Upgrade shim | Sep 29, 2021 | Sep 10, 2019 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory31 | Nov 27, 2019 | Sep 10, 2019 |
| Oracle Solaris | — | Upgrade library/security/openssl/openssl-fips-140 to version 2.0.15-0.175.3.36.0.27.0 on Solaris 11.3Upgrade library/security/openssl to version 1.0.2.26-0.175.3.36.0.27.0 on Solaris 11.3Upgrade library/security/openssl to version 1.0.2.20-11.4.16.0.1.1.0 on Solaris 11.4Upgrade library/security/openssl/openssl-fips-140 to version 2.0.15-11.4.16.0.1.1.0 on Solaris 11.4 | Dec 18, 2019 | Sep 10, 2019 |
| Oracle_linux | — | Upgrade openssl-libsUpgrade openssl-develUpgrade openssl-perlUpgrade openssl | Jul 22, 2024 | Sep 10, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Sep 10, 2019 |
| Redhat_linux | — | Upgrade openssl-perlUpgrade openssl-develUpgrade openssl-libsUpgrade openssl-debuginfoNo solution existsUpgrade openssl-libs-debuginfoUpgrade opensslUpgrade openssl-debugsource | Apr 29, 2020 | Sep 10, 2019 |
| Suse | — | Upgrade libopenssl-1_0_0-devel-32bitUpgrade libopenssl1_1-hmacUpgrade libopenssl0_9_8-hmac-32bitUpgrade libopenssl0_9_8-hmacUpgrade openssl-1_0_0Upgrade openssl1-docUpgrade libopenssl1_0_0-hmac-32bitUpgrade libopenssl1_0_0-steamUpgrade openssl-1_0_0-docUpgrade openssl-docUpgrade libopenssl-1_1-develUpgrade libopenssl-develUpgrade libopenssl0_9_8Upgrade libopenssl-1_1-devel-32bitUpgrade openssl-1_1Upgrade libopenssl0_9_8-32bitUpgrade libopenssl1_1-32bitUpgrade libopenssl1_0_0Upgrade libopenssl1_0_0-steam-32bitUpgrade libopenssl10Upgrade libopenssl1_0_0-x86Upgrade libopenssl-1_0_0-develUpgrade openssl1Upgrade libopenssl1_0_0-hmacUpgrade openssl-1_1-docUpgrade libopenssl1_0_0-32bitUpgrade opensslUpgrade libopenssl1_1-hmac-32bitUpgrade openssl-1_0_0-cavsUpgrade libopenssl1-develUpgrade libopenssl1_1 | Sep 18, 2019 | Sep 10, 2019 |
| Ubuntu | — | Upgrade libssl1.0.0Upgrade libssl1.0.0 (Ubuntu Pro)Upgrade libssl1.1 | May 29, 2020 | Sep 10, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub