Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2019-1551

CVE-2019-1551MEDIUM

OpenSSL OpenSSL — rsaz_512_sqr overflow bug on x86_64

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  N  N    5.3   .1430   96.6     —

AFFECTED
  Product  Versions                                           Fixed
  OpenSSL  Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d) –  —

TIMELINE
  Nov 28  Reserved by openssl
  Dec 6   Published (CNA: openssl)
  Oct 8   ENRICHED — CVE-2019-1551 (OpenSSL). Received CVSS 5.3 and CPE data from NVD.

CWE-190 · CNA: openssl · CVSS v3.1 · 24 references · NVD status: Modified

Description

There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
November 28, 2018	Reserved	Reserved by openssl
December 6, 2019	Published	Published (CNA: openssl)
October 8, 2026	ENRICHED	ENRICHED — CVE-2019-1551 (OpenSSL). Received CVSS 5.3 and CPE data from NVD.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
OpenSSL	OpenSSL	—	Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d)	—

Weaknesses

CWE-190

References (24)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html [Mailing List, Third Party Advisory]
http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html [Third Party Advisory, VDB Entry]
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=419102400a2811582a7a3d4a4e317d72e5ce0a8f
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f1c5eea8a817075d31e43f5876993c6710238c98
https://lists.debian.org/debian-lts-announce/2022/03/msg00023.html [Mailing List, Third Party Advisory]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/
https://seclists.org/bugtraq/2019/Dec/39 [Mailing List, Third Party Advisory]
https://seclists.org/bugtraq/2019/Dec/46 [Mailing List, Third Party Advisory]
https://security.gentoo.org/glsa/202004-10 [Third Party Advisory]
https://security.netapp.com/advisory/ntap-20191210-0001/ [Third Party Advisory]
https://usn.ubuntu.com/4376-1/ [Third Party Advisory]
https://usn.ubuntu.com/4504-1/ [Third Party Advisory]
https://www.debian.org/security/2019/dsa-4594 [Third Party Advisory]
https://www.debian.org/security/2021/dsa-4855 [Third Party Advisory]
https://www.openssl.org/news/secadv/20191206.txt [Vendor Advisory]
https://www.oracle.com/security-alerts/cpuApr2021.html [Patch, Third Party Advisory]
https://www.oracle.com/security-alerts/cpujan2021.html [Patch, Third Party Advisory]
https://www.oracle.com/security-alerts/cpujul2020.html [Patch, Third Party Advisory]
https://www.tenable.com/security/tns-2019-09 [Third Party Advisory]
https://www.tenable.com/security/tns-2020-03 [Third Party Advisory]
https://www.tenable.com/security/tns-2020-11 [Third Party Advisory]
https://www.tenable.com/security/tns-2021-10 [Third Party Advisory]

Authoritative record: CVE-2019-1551 at cve.org

Vendors: openssl

Weaknesses: CWE-190

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2019-1551 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.