Skip to content
OpenAdvisories
Unscored DSA-4540-1 2 CVEs

openssl1.0 - security update

Published Oct 1, 2019 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 openssl1.0 1.0.2t-1~deb9u1

Vulnerabilities 2

  • Unscored —
    CVE-2019-1547

    ECDSA remote timing attack

    Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is p…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-1563

    Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey

    In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine