Veracode Vulnerability DatabaseVERACODE:26142Sensitive Information Disclosure
EPSS
Percentile
81.5%
Arm Mbed TLS is vulnerable to sensitive information leakage. When deterministic ECDSA is enabled, it uses an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times.
References
github.com/ARMmbed/mbedtls/commit/298a43a77ec0ed2c19a8c924ddd8571ef3e65dfd
github.com/ARMmbed/mbedtls/commit/33f66ba6fd234114aa37f0209dac031bb2870a9b
lists.debian.org/debian-lts-announce/2022/12/msg00036.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CGSKQSGR5SOBRBXDSSPTCDSBB5K3GMPF/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSFFOROD6IVLADZHNJC2LPDV7FQRP7XB/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEHHH2DOBXB25CAU3Q6E66X723VAYTB5/
lists.fedoraproject.org/archives/list/[email protected]/message/CGSKQSGR5SOBRBXDSSPTCDSBB5K3GMPF/
lists.fedoraproject.org/archives/list/[email protected]/message/CSFFOROD6IVLADZHNJC2LPDV7FQRP7XB/
lists.fedoraproject.org/archives/list/[email protected]/message/PEHHH2DOBXB25CAU3Q6E66X723VAYTB5/
tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-10
Related
