VDB
ALPINE-CVE-2019-18222
ALPINE-CVE-2019-18222
PUBLISHED
CVSS 4.699999809265137 MEDIUM
The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.
Risk Scores
CVSS 3.1
4.699999809265137
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.13 | mbedtls | 2.1.2-r0, 2.11.0-r0, 2.14.1-r0 |
| Alpine:v3.15 | mbedtls | 2.16.1-r1, 2.6.1-r0, 2.7.0-r0 |
| Alpine:v3.16 | mbedtls | 0, 0, 2.7.0-r0 |
| Alpine:v3.10 | mbedtls | 2.6.0-r0, 0, 2.0.0-r0 |
| Alpine:v3.21 | mbedtls | 0, 2.7.0-r0, 2.6.1-r0 |
| Alpine:v3.18 | mbedtls | 2.16.0-r0, 2.0.0-r0, 2.1.2-r0 |
| Alpine:v3.12 | mbedtls | 0, 0, 2.7.0-r0 |
| Alpine:v3.20 | mbedtls | 2.16.1-r1, 0, 2.1.2-r0 |
| Alpine:v3.22 | mbedtls | 2.1.2-r0, 0, 2.0.0-r0 |
| Alpine:v3.24 | mbedtls | 0, 0 |
| Alpine:v3.19 | mbedtls | 2.2.0-r0, 2.1.2-r0, 2.0.0-r0 |
| Alpine:v3.17 | mbedtls | 0, 2.1.2-r0, 2.0.0-r0 |
| Alpine:v3.11 | mbedtls | 2.14.1-r0, 2.0.0-r0, 2.1.2-r0 |
| Alpine:v3.14 | mbedtls | 2.16.3-r0, 0, 0 |
| Alpine:v3.23 | mbedtls | 0, 2.6.1-r0, 2.6.0-r0 |
Timeline
- Jan 23, 2020 CVE Published
- Apr 30, 2026 Distribution Patch
- Jun 9, 2026 CVE Updated