REDHAT-BUG-1752100
First published: Fri Sep 13 2019(Updated: )
In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s). Reference: <a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64">https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64</a> <a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97">https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97</a> <a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f">https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f</a> <a href="https://seclists.org/bugtraq/2019/Sep/25">https://seclists.org/bugtraq/2019/Sep/25</a> <a href="https://www.openssl.org/news/secadv/20190910.txt">https://www.openssl.org/news/secadv/20190910.txt</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenSSL libcrypto | >=1.1.1<1.1.1c>=1.1.0<1.1.0k>=1.0.2<1.0.2s |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f
- https://seclists.org/bugtraq/2019/Sep/25
- https://www.openssl.org/news/secadv/20190910.txt
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1752101
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1752103
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1752102
- https://access.redhat.com/support/policy/updates/jboss_notes
- https://access.redhat.com/security/cve/CVE-2019-1547
- https://access.redhat.com/security/cve/CVE-2019-1549
- https://access.redhat.com/security/cve/CVE-2019-1551
- https://access.redhat.com/security/cve/CVE-2019-1563
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1752100#c11
- https://access.redhat.com/support/cases/#/case/02620079
- https://access.redhat.com/errata/RHSA-2020:1336
- https://access.redhat.com/errata/RHSA-2020:1337
- https://access.redhat.com/security/cve/cve-2019-1563
- https://access.redhat.com/errata/RHSA-2020:1840
- https://bugzilla.redhat.com/show_bug.cgi?id=1752100
Frequently Asked Questions
What are the potential impacts of REDHAT-BUG-1752100?
An attacker can recover a CMS/PKCS7 transported encryption key or decrypt RSA encrypted messages after analyzing the responses to decryption attempts.
What versions of OpenSSL are affected by REDHAT-BUG-1752100?
OpenSSL versions 1.1.1 to 1.1.1c, 1.1.0 to 1.1.0k, and 1.0.2 to 1.0.2s are vulnerable to REDHAT-BUG-1752100.
How can I mitigate the risks associated with REDHAT-BUG-1752100?
To mitigate the risks of REDHAT-BUG-1752100, upgrade OpenSSL to a version that addresses this vulnerability.
Is REDHAT-BUG-1752100 related to specific encryption types?
Yes, REDHAT-BUG-1752100 specifically affects CMS/PKCS7 encryption and RSA encrypted messages.
What should I do if I am using a vulnerable version identified in REDHAT-BUG-1752100?
If using a vulnerable version identified in REDHAT-BUG-1752100, it is crucial to update to the latest patched version of OpenSSL as soon as possible.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/source
- agent/severity
- agent/description
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/tags
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-1563
- vendor/openssl
- canonical/openssl libcrypto