CVE-2019-1559

30

FAUCET Score

CVE-2019-1559 is a padding oracle vulnerability in OpenSSL versions 1.0.2 through 1.0.2q, affecting numerous products including Canonical, Debian, and Red Hat. This medium-severity vulnerability (CVSS 5.9) allows for data decryption if an application incorrectly calls SSL_shutdown() twice after a fatal protocol error and uses "non-stitched" ciphersuites. Exploitation requires a high attack complexity, but if successful, it could lead to the compromise of sensitive information. There is no known active exploitation, public exploit code, or Metasploit/Nuclei modules, and community discussion is minimal.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 1.0.2, < 1.0.2rCPE matchmatch criteria	cpe:2.3:a:openssl:openssl::::::::
		16.04CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::
		18.04CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
		18.10CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:18.10:::::::*
		8.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:8.0:::::::*

CVSS Data

CVSS version used by this source: 3.1

5.9MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Exploitability Score

2.2

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

17.14%

Probability of exploitation in next 30 days

EPSS Percentile

96.8%

Percentile rank of EPSS score among Peer Group

As of 2026-07-25

Model: v2026.06.15

This CVE's current EPSS score of 0.1714 is in the 97th percentile among its peer group of 19,955 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (41)

oraclepatch availablevia nvd_reference

redhatpatch availablevia redhat_api

Product: Red Hat Ansible Tower 3.4 for RHEL 7Fixed in: ansible-tower-34/ansible-tower-memcached:1.4.15-28

redhatpatch availablevia redhat_api

Product: Red Hat Ansible Tower 3.4 for RHEL 7Fixed in: ansible-tower-35/ansible-tower-memcached:1.4.15-28

redhatpatch availablevia redhat_api

Product: Red Hat Ansible Tower 3.4 for RHEL 7Fixed in: ansible-tower-37/ansible-tower-memcached-rhel7:1.4.15-28

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: openssl-0:1.0.1e-58.el6_10

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: openssl-1:1.0.2k-19.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5Fixed in: openssl

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 6Fixed in: jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 6Fixed in: jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 6Fixed in: jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 6Fixed in: jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 6Fixed in: jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 6Fixed in: jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 7Fixed in: jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 7Fixed in: jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 7Fixed in: jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 7Fixed in: jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 7Fixed in: jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 7Fixed in: jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 7Fixed in: jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 8Fixed in: jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 8Fixed in: jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 8Fixed in: jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 8Fixed in: jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 8Fixed in: jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 8Fixed in: jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 8Fixed in: jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws

redhatpatch availablevia redhat_api

Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Fixed in: imgbased-0:1.1.9-0.1.el7ev

redhatpatch availablevia redhat_api

Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Fixed in: ovirt-node-ng-0:4.3.5-0.20190717.0.el7ev

redhatpatch availablevia redhat_api

Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Fixed in: redhat-release-virtualization-host-0:4.3.5-2.el7ev

redhatpatch availablevia redhat_api

Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Fixed in: redhat-virtualization-host-0:4.3.5-20190722.0.el7_7

redhatpatch availablevia redhat_api

Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Fixed in: rhvm-appliance-0:4.3-20190722.0.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.2 on RHEL 6Fixed in: jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws

redhatno patchvia redhat_api

Product: Red Hat JBoss Core ServicesFixed in: openssl

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: openssl098e

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: OVMF

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: compat-openssl10

redhatend of lifevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 5Fixed in: openssl

redhatend of lifevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 6Fixed in: openssl

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: openssl098e

redhatend of lifevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2Fixed in: openssl

Vendor Advisories (1)

redhatCVE-2019-1559Moderate

openssl: 0-byte record padding oracle

References

lists.opensuse.org / opensuse-security-announce/2019-03/msg00041.html

Mailing ListThird Party Advisory

lists.opensuse.org / opensuse-security-announce/2019-04/msg00019.html

Mailing ListThird Party Advisory

lists.opensuse.org / opensuse-security-announce/2019-04/msg00046.html

Mailing ListThird Party Advisory

lists.opensuse.org / opensuse-security-announce/2019-04/msg00047.html

Mailing ListThird Party Advisory

lists.opensuse.org / opensuse-security-announce/2019-05/msg00049.html

Mailing ListThird Party Advisory

lists.opensuse.org / opensuse-security-announce/2019-06/msg00080.html

Mailing ListThird Party Advisory

access.redhat.com / errata/RHSA-2019:2304

Third Party Advisory

access.redhat.com / errata/RHSA-2019:2437

Third Party Advisory

access.redhat.com / errata/RHSA-2019:2439

Third Party Advisory

access.redhat.com / errata/RHSA-2019:2471

Third Party Advisory

access.redhat.com / errata/RHSA-2019:3929

Third Party Advisory

access.redhat.com / errata/RHSA-2019:3931

Third Party Advisory

git.openssl.org / gitweb

kc.mcafee.com / corporate/index

Third Party Advisory

lists.debian.org / debian-lts-announce/2019/03/msg00003.html

Mailing ListThird Party Advisory

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V

security.gentoo.org / glsa/201903-10

Third Party Advisory

security.netapp.com / advisory/ntap-20190301-0001

PatchThird Party Advisory

security.netapp.com / advisory/ntap-20190301-0002

Broken LinkThird Party Advisory

security.netapp.com / advisory/ntap-20190423-0002

Third Party Advisory

support.f5.com / csp/article/K18549143

Third Party Advisory

support.f5.com / csp/article/K18549143

usn.ubuntu.com / 3899-1

Third Party Advisory

usn.ubuntu.com / 4376-2

Broken Link

debian.org / security/2019/dsa-4400

Third Party Advisory

openssl.org / news/secadv/20190226.txt

Vendor Advisory

oracle.com / security-alerts/cpujan2020.html

Third Party Advisory

oracle.com / security-alerts/cpujan2021.html

Third Party Advisory

oracle.com / technetwork/security-advisory/cpuapr2019-5072813.html

PatchThird Party Advisory

oracle.com / technetwork/security-advisory/cpujul2019-5072835.html

PatchThird Party Advisory

oracle.com / technetwork/security-advisory/cpuoct2019-5072832.html

PatchThird Party Advisory

tenable.com / security/tns-2019-02

PatchThird Party Advisory

tenable.com / security/tns-2019-03

Third Party Advisory

securityfocus.com / bid/107174

Third Party AdvisoryVDB Entry