CVE-2019-18222 log
| Source |
|
| Severity | High |
| Remote | No |
| Type | Private key recovery |
| Description | The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto before 3.0.1 and Mbed TLS before 2.20.0, 2.16.4 or 2.7.13 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks. |
| Group | Package | Affected | Fixed | Severity | Status | Ticket |
|---|---|---|---|---|---|---|
| AVG-1104 | mbedtls | 2.16.3-1 | 2.16.5-1 | High | Fixed |
| Date | Advisory | Group | Package | Severity | Type |
|---|---|---|---|---|---|
| 11 Mar 2020 | ASA-202003-7 | AVG-1104 | mbedtls | High | private key recovery |
| References |
|---|
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-12 |