PT-2019-13605 · Cryptopp+2 · Crypto+++2

Keegan Ryan · Publicado 2019-07-30 · Atualizado 2024-06-15 · CVE-2019-14318

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Crypto++ versions 8.3.0 and earlier

Description The issue is a timing side channel in ECDSA signature generation, allowing a local or remote attacker to compute the private key used by measuring the duration of hundreds to thousands of signing operations. This occurs due to non-constant time scalar multiplication in ecp.cpp and algebra.cpp, which leaks information such as the bit length of the scalar.

Recommendations For Crypto++ versions 8.3.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-417

Identificadores relacionados

ALT-PU-2021-2104

CVE-2019-14318

MGASA-2019-0362

OPENSUSE-SU-2019:1968-1

OPENSUSE-SU-2019_1968-1

OPENSUSE-SU-2024:10933-1

Produtos afetados

Alt Linux

Crypto++

Suse

Referências · 24

• 🔥 https://eprint.iacr.org/2011/232.pdf · Exploit
• https://github.com/weidai11/cryptopp/issues/869 · Correção
• https://advisories.mageia.org/MGASA-2019-0362.html · Nota de Segurança
• https://bugzilla.suse.com/1143532 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14318 · Aviso do Fabricante
• https://tches.iacr.org/index.php/TCHES/article/view/7337 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-14318 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/10/02/2 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2019:1968-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-14318 · Aviso do Fabricante
• https://minerva.crocs.fi.muni.cz · Nota
• https://lists.opensuse.org/opensuse-updates/2019-08/msg00155.html · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/PIBT23NESB2572K3CT3URDK6WH7QTD3Y/#PIBT23NESB2572K3CT3URDK6WH7QTD3Y · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00066.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-14318 · Aviso do Fabricante