MGASA-2020-0130
Updated mbedtls packages fix security vulnerabilities
Updated mbedtls packages fix security vulnerabilities:
If Mbed TLS is running in an SGX enclave and the adversary has control of the main operating system, they can launch a side channel attack to recover the RSA private key when it is being imported. Found by Alejandro Cabrera Aldaya and Billy Brumley and reported by Jack Lloyd.
Fix potential memory overread when performing an ECDSA signature operation. The overread only happens with cryptographically low probability (of the order of 2^-n where n is the bitsize of the curve) unless the RNG is broken, and could result in information disclosure or denial of service (application crash or extra resource consumption). Found by Auke Zeilstra and Peter Schwabe, using static analysis.
What each source reports
OSV No score
Updated mbedtls packages fix security vulnerabilities
Updated mbedtls packages fix security vulnerabilities:
If Mbed TLS is running in an SGX enclave and the adversary has control of the main operating system, they can launch a side channel attack to recover the RSA private key when it is being imported. Found by Alejandro Cabrera Aldaya and Billy Brumley and reported by Jack Lloyd.
Fix potential memory overread when performing an ECDSA signature operation. The overread only happens with cryptographically low probability (of the order of 2^-n where n is the bitsize of the curve) unless the RNG is broken, and could result in information disclosure or denial of service (application crash or extra resource consumption). Found by Auke Zeilstra and Peter Schwabe, using static analysis.
- Record
MGASA-2020-0130- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mbedtlsMageia:7 |
before 2.16.5-1.mga7 | 2.16.5-1.mga7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
MGASA-2020-0130 is a vulnerability with no CVSS score yet in mbedtls, published March 8, 2020. No source lists public exploit code. Fixed in mbedtls 2.16.5-1.mga7.