PT-2019-14862 · Arm+2 · Arm Mbed Tls+3

Published 2019-09-26 · Updated 2023-03-03 · CVE-2019-16910

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Arm Mbed TLS versions prior to 2.19.0 Arm Mbed Crypto versions prior to 2.0.0

Description The issue arises when deterministic ECDSA is enabled, and an RNG with insufficient entropy for blinding is used. This might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times.

Recommendations For Arm Mbed TLS versions prior to 2.19.0, update to version 2.19.0 or apply the fix available in versions 2.7.12 and 2.16.3. For Arm Mbed Crypto versions prior to 2.0.0, update to version 2.0.0.

Fix

Related Identifiers

ALT-PU-2019-3076

ALT-PU-2019-3152

CVE-2019-16910

DLA-3249-1

MGASA-2020-0053

Affected Products

Alt Linux

Arm Mbed Crypto

Arm Mbed Tls

Astra Linux

References · 24

• https://github.com/ARMmbed/mbedtls/commit/298a43a77ec0ed2c19a8c924ddd8571ef3e65dfd · Patch
• https://github.com/ARMmbed/mbedtls/commit/33f66ba6fd234114aa37f0209dac031bb2870a9b · Patch
• https://advisories.mageia.org/MGASA-2020-0053.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-16910 · Vendor Advisory
• https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-10 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16910 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2019-16910 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSFFOROD6IVLADZHNJC2LPDV7FQRP7XB · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEHHH2DOBXB25CAU3Q6E66X723VAYTB5 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0053 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-16910 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3249-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-16910 · Security Note
• https://ubuntu.com/security/CVE-2019-16910 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CGSKQSGR5SOBRBXDSSPTCDSBB5K3GMPF · Vendor Advisory