Veracode Vulnerability DatabaseVERACODE:26113Information Disclosure
EPSS
Percentile
19.8%
mbedtls is vulnerable to information disclosure. The vulnerability exists as the ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.
References
lists.debian.org/debian-lts-announce/2022/12/msg00036.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A3GWQNONS7GRORXZJ7MOJFUEJ2ZJ4OUW/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NGDACU65MYZXXVPQP2EBHUJGOR4RWLVY/
lists.fedoraproject.org/archives/list/[email protected]/message/A3GWQNONS7GRORXZJ7MOJFUEJ2ZJ4OUW/
lists.fedoraproject.org/archives/list/[email protected]/message/NGDACU65MYZXXVPQP2EBHUJGOR4RWLVY/
tls.mbed.org/tech-updates/security-advisories
tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-12
Related
