CVE-2019-18222 - The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks

Back Back to CVE browser

MEDIUM

The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks

Published Jan 23, 2020

4.7

MEDIUM

CVSS 3.1

EPSS 0.34%

Description

The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-203

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8022
Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
mailing-listMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A3GWQNONS7GRORXZJ7MOJFUEJ2ZJ4OUW/
vendor-advisoryMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NGDACU65MYZXXVPQP2EBHUJGOR4RWLVY/
vendor-advisoryMailing ListThird Party Advisory
https://tls.mbed.org/tech-updates/security-advisories
Vendor Advisory
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-12
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8022		Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html		mailing-listMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A3GWQNONS7GRORXZJ7MOJFUEJ2ZJ4OUW/		vendor-advisoryMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NGDACU65MYZXXVPQP2EBHUJGOR4RWLVY/		vendor-advisoryMailing ListThird Party Advisory
https://tls.mbed.org/tech-updates/security-advisories		Vendor Advisory
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-12		Vendor Advisory