VDB
CVE-2019-18222
CVE-2019-18222
PUBLISHED
CVSS 4.699999809265137 MEDIUM
The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.
EPSS 0.34% · 26.8th percentile
Risk Scores
CVSS 3.1
4.699999809265137
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.34%
26.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:18.04:LTS | mbedtls | 0, 2.6.0-1, 2.7.0-2 |
| Ubuntu:16.04:LTS | mbedtls | 2.2.1-1, 0, 2.2.1-2ubuntu0.2 |
Timeline
- Jan 23, 2020 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 1, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 4, 2022 EPSS Score
- Sep 6, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2019-18222 third-party-advisory
- https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-12 third-party-advisory
- https://tls.mbed.org/tech-updates/security-advisories third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2019-18222 third-party-advisory