OpenSSL Advisory: December 6th, 2019 (BoringSSL Not Affected)

OpenSSL have published a security advisory. Here's how it affects BoringSSL:

CVE	Summary	Severity in OpenSSL	Impact to BoringSSL
CVE-2019-1551	rsaz_512_sqr overflow bug on x86_64	Low	Not affected, impacted code was removed from BoringSSL in 2016

CVE-2019-1551

There was an overflow bug in OpenSSL’s x86_64 optimizations. This affected modular exponentiation with 512-bit moduli and secret exponent, most commonly used by 1024-bit RSA. OpenSSL’s advisory additionally lists 3-prime RSA1536, DSA1024, and DH512. (We suspect that the listing of DSA1024 rather than DSA512 might be a mistake.)

BoringSSL is not affected by this bug, having removed the relevant code at the end of 2016.