ByteOS Network

NVD Vulnerability Details :

CVE-2019-14318

Modified

Source-cve@mitre.org

Published At-30 Jul, 2019 | 17:15

Updated At-20 Aug, 2019 | 18:15

Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because scalar multiplication in ecp.cpp (prime field curves, small leakage) and algebra.cpp (binary field curves, large leakage) is not constant time and leaks the bit length of the scalar among other information.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	5.9	MEDIUM	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.0

Base score: 5.9

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:P/I:N/A:N

CPE Matches

cryptopp>>crypto\+\+>>Versions up to 8.3.0(inclusive)

cpe:2.3:a:cryptopp:crypto\+\+:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-417	Primary	nvd@nist.gov

CWE ID: CWE-417

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00066.html	cve@mitre.org	N/A
http://www.openwall.com/lists/oss-security/2019/10/02/2	cve@mitre.org	N/A
https://eprint.iacr.org/2011/232.pdf	cve@mitre.org	Exploit Third Party Advisory
https://github.com/weidai11/cryptopp/issues/869	cve@mitre.org	Patch Third Party Advisory
https://minerva.crocs.fi.muni.cz/	cve@mitre.org	N/A
https://tches.iacr.org/index.php/TCHES/article/view/7337	cve@mitre.org	Third Party Advisory