Skip to content
OpenAdvisories
Unscored DLA-1932-1 2 CVEs

openssl - security update

Published Sep 25, 2019 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 8 openssl 1.0.1t-1+deb8u12

Vulnerabilities 2

  • Unscored —
    CVE-2019-1547

    ECDSA remote timing attack

    Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is p…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-1563

    Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey

    In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine