CVE-2019-1563

mediumpriority · track · 16OT risk · elevatedEPSS 0.038 · 90 %ileDEEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
3.84% (90th) EPSS
CVSS 4.3 · medium
Is it mine?
140 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-23

In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedAPM Edgecisa_csaf_ot

    Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.

  • MitigationAPM Edgecisa_csaf_ot

    Do not directly connect to the Internet.

02

cvss

Technical severity, 0–10. One row per scoring source.

4.3
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.4–4.3

v2.04.3mediumAV:N/AC:M/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 8.6 · impact 2.9
v3.13.7lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:Nprimary · NVD / NIST USexploitability 2.2 · impact 1.4
v3.03.7lowCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · CISA US
v3.13.7lowAV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · FSTEC (BDU) RU
v3.13.4lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-203USprimaryCWE-327USprimaryCWE-311USCWE-327US
04

affected products (140)

Products and version ranges known to be affected.

showing 20 of 140
05

advisories (3)

Vendor and ecosystem advisories describing this.

  • WID-SEC-W-2023-1049Oracle MySQL: Mehrere SchwachstellenDeutsch2020-04-14csaf · cert_bundDE

    Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Verfügbarkeit, Vertraulichkeit und Integrität zu gefährden.

  • WID-SEC-W-2023-1762OpenSSL: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2019-09-10csaf · cert_bundDE

    Ein entfernter Angreifer kann eine Schwachstelle in OpenSSL ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

  • ICSA-21-336-06Hitachi Energy APM Edge2021-12-02icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability could cause the product to become inaccessible.

06

also known as (4)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducert_bundcisa_csaf_otNVDCVE.orgMITRE
published 2019-09-10modified 2026-06-17
09

references (171)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan