Critical Vulnerability in OpenSSL: Bleichenbacher Padding Oracle Attack
Summary
ALPINE-CVE-2019-1563: In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transp... Affects openssl versions < 1.1.1d-r0. Fixed in 1.1.1d-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely used open-source software library that provides robust cryptographic functions, including SSL and TLS protocols for secure communication over networks. It is integral to many applications and services, ensuring data integrity and confidentiality. However, certain versions of OpenSSL are vulnerable to a specific attack that can compromise encrypted data, making it crucial for users to be aware of and address these vulnerabilities.
Vulnerability Detail
The vulnerability, identified as CVE-2019-1563, arises from a flaw in the handling of CMS/PKCS7 encrypted messages. An attacker can exploit this vulnerability through a Bleichenbacher padding oracle attack, which allows them to decrypt RSA-encrypted messages or recover encryption keys after sending numerous decryption requests. This vulnerability affects OpenSSL versions 1.1.1 through 1.1.1c, as well as earlier versions, posing significant risks to applications relying on these versions for secure communications.
How To Fix
Minimum fixed version
1.1.1d-r0
This is the first release that contains the fix.
sudo apk add --upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While waiting for the patch, it is advisable to avoid using the vulnerable functions without proper certificate validation. Applications should implement additional checks to ensure that the correct recipient info is selected during decryption processes.
Conclusion
The vulnerability CVE-2019-1563 in OpenSSL poses significant risks to applications relying on the affected versions. Users are strongly encouraged to update to the patched versions to mitigate potential attacks. Awareness and proactive measures are essential to maintaining secure communications.
See every vulnerability recorded for openssl →
FAQ
CVE-2019-1563 is a vulnerability in OpenSSL that allows attackers to exploit a padding oracle attack to decrypt RSA-encrypted messages.
Affected versions include OpenSSL 1.1.1 through 1.1.1c, as well as earlier versions like 1.0.2 and 1.1.0.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2019-1563 is 3.7, indicating a moderate level of severity.
If immediate updates are not possible, ensure that your applications validate certificates properly and avoid using vulnerable decryption functions.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
