CVE-2019-1551 OpenSSL
| Affected software | OpenSSL |
|---|---|
| Severity | 5.3 Medium CVSS 3.1 2 scores |
| Weakness | Integer overflow (CWE-190) |
| Published | 6 Dec 2019 |
| Updated | 8 Oct 2026 |
Description
There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 6 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC none indexed
- EPSS 14% chance in 30 days A model's forecast, not a report of exploitation. Higher than 97% of all scored CVEs.
Waratek protection
A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.
- Protection none
- Action not pursued none
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product. |
CVSS
5.3 MEDIUM
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
2 metrics
CVSS
5.3 MEDIUM v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
NVD | Primary | published |
| CVSS 2.0 | 5.0 | none | AV:N/AC:L/Au:N/C:P/I:N/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update July 2020 ↗ | CPU | 2020-Q3 | Oracle Enterprise Manager / Networking (OpenSSL) (12.4.0.0) Oracle MySQL / Monitoring: General (OpenSSL) (4.0.12 and prior, 8.0.20 and prior) Oracle PeopleSoft / Security (OpenSSL) (8.56, 8.57, 8.58) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Enterprise Manager | Networking (OpenSSL) | 12.4.0.0 | 12.4.0.0 |
| Oracle MySQL | Monitoring: General (OpenSSL) | 4.0.12 and prior, 8.0.20 and prior | |
| Oracle PeopleSoft | Security (OpenSSL) | 8.56, 8.57, 8.58 | 8.56 · 8.57 · 8.58 |
Products and versions
9 products, 18 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | canonical | ubuntu linux | generic | 16.04 · 18.04 · 19.10 |
| nvd | debian | debian linux | generic | 9.0 · 10.0 |
| nvd | fedoraproject | fedora | generic | 30 · 31 · 32 |
| nvd | openssl | openssl | generic | ≥ 1.0.2 and ≤ 1.0.2 · ≥ 1.1.1 and ≤ 1.1.1 |
| nvd | opensuse | leap | generic | 15.1 |
| nvd | oracle | enterprise manager ops center | generic | 12.4.0.0 |
| nvd | oracle | mysql enterprise monitor | generic | ≤ 4.0.12 · ≥ 8.0.0 and ≤ 8.0.20 |
| nvd | oracle | peoplesoft enterprise peopletools | generic | 8.56 · 8.57 · 8.58 |
| nvd | tenable | log correlation engine | generic | ＜ 6.0.9 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** SECURITY (OPENSSL), HTTPS, MONITORING: GENERAL (OPENSSL), NO AUTH REMOTE EXPLOIT, NETWORKING (OPENSSL) **Products:** ORACLE PEOPLESOFT, ORACLE ENTERPRISE MANAGER, ENTERPRISE MANAGER OPS CENTER, PEOPLESOFT ENTERPRISE PEOPLETOOLS, OPENSSL, MYSQL ENTERPRISE MONITOR, ORACLE MYSQL
References
Timeline
Timeline
| Published | 2019-12-06 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-10-08 | NVD's own last-modified date for this record. |