Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Debian · 9 | openssl1.0 | 1.0.2r-1~deb9u1 |
Vulnerabilities 1
-
Unscored —CVE-2019-1559 EPSS 17%
0-byte record padding oracle
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding …