CVE-2019-18222 - log back

CVE-2019-18222 edited at 11 Mar 2020 10:22:10
Severity
- Critical
+ High
CVE-2019-18222 edited at 11 Mar 2020 10:19:54
Description
- The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.
+ The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto before 3.0.1 and Mbed TLS before 2.20.0, 2.16.4 or 2.7.13 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.
CVE-2019-18222 edited at 29 Feb 2020 13:29:01
Severity
- Unknown
+ Critical
Remote
- Unknown
+ Local
Type
- Unknown
+ Private key recovery
Description
+ The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.
References
+ https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-12
Notes
CVE-2019-18222 created at 25 Feb 2020 15:59:28