Homepage
About Snyk

Information Exposure Affecting mbedtls package, versions <2.16.4-1

0.0
medium

Snyk CVSS

    Attack Complexity High
    Confidentiality High

    Threat Intelligence

    EPSS 0.05% (19th percentile)
Expand this section
NVD
4.7 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DEBIAN11-MBEDTLS-543109
  • published 23 Jan 2020
  • disclosed 23 Jan 2020
Report a new vulnerability Found a mistake?

Introduced: 23 Jan 2020

CVE-2019-18222 Open this link in a new tab
CWE-200 Open this link in a new tab

How to fix?

Upgrade Debian:11 mbedtls to version 2.16.4-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream mbedtls package and not the mbedtls package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.