PT-2020-9946 · Arm+2 · Arm Mbed Crypto+3

Published 2020-01-23 · Updated 2023-03-03 · CVE-2019-18222

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 2.1 through 2.19.1 Arm Mbed Crypto version 2.1

Description The issue concerns the ECDSA signature implementation in ecdsa.c, which does not reduce the blinded scalar before computing the inverse. This allows a local attacker to recover the private key via side-channel attacks.

Recommendations For Mbed TLS versions 2.1 through 2.19.1, update to a version that fixes the issue with the ECDSA signature implementation. For Arm Mbed Crypto version 2.1, update to a version that fixes the issue with the ECDSA signature implementation. As a temporary workaround, consider restricting access to sensitive operations that rely on the ECDSA signature implementation until a patch is available.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

ALT-PU-2020-1192

ALT-PU-2020-2355

CVE-2019-18222

DLA-3249-1

MGASA-2020-0053

Affected Products

Alt Linux

Arm Mbed Crypto

Astra Linux

Mbed Tls

References · 22

• https://security-tracker.debian.org/tracker/CVE-2019-18222 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NGDACU65MYZXXVPQP2EBHUJGOR4RWLVY · Vendor Advisory
• https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-12 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-18222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18222 · Security Note
• https://tls.mbed.org/tech-updates/security-advisories · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-18222 · Security Note
• https://ubuntu.com/security/CVE-2019-18222 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2019-18222 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3249-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-18222 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0053 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A3GWQNONS7GRORXZJ7MOJFUEJ2ZJ4OUW · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0053.html · Security Note
• https://osv.dev/vulnerability/CVE-2019-18222 · Vendor Advisory