{"id":"CVE-2019-18222","aliases":["ALPINE-CVE-2019-18222","DEBIAN-CVE-2019-18222","DLA-3249-1","EUVD-2019-8022","GHSA-fpgh-hvp5-cqc2","JLSEC-2025-199","MGASA-2020-0053","UBUNTU-CVE-2019-18222"],"status":"published","title":"The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1...","description":"The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0034,"percentile":0.27637,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-203"],"published":"2020-01-23T00:00:00Z","modified":"2026-10-24T10:31:04Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"mbedtls","fixed_in":["2.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"mbedtls","fixed_in":["2.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"mbedtls","fixed_in":["2.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"mbedtls","fixed_in":["2.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"mbedtls","fixed_in":["2.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"mbedtls","fixed_in":["2.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"mbedtls","fixed_in":["2.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"mbedtls","fixed_in":["2.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"mbedtls","fixed_in":["2.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"mbedtls","fixed_in":["2.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"mbedtls","fixed_in":["2.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"mbedtls","fixed_in":["2.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"mbedtls","fixed_in":["2.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"mbedtls","fixed_in":["2.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"mbedtls","fixed_in":["2.16.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mbedtls","fixed_in":["2.16.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mbedtls","fixed_in":["2.16.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mbedtls","fixed_in":["2.16.4-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"MbedTLS_jll","fixed_in":["2.16.6+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.9-0~deb10u1"}]}],"versions":["2.16.0-1","2.16.2-1","2.16.3-1","2.16.4-1","2.16.5-1"],"bundled":18},{"source":"osv","ecosystem":"Julia","package":"MbedTLS_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.16.6+0"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.4-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.2-1","2.2.0-1","2.2.1-1","2.2.1-2","2.2.1-2ubuntu0.1","2.2.1-2ubuntu0.2","2.2.1-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.1-1ubuntu1","2.6.0-1","2.7.0-2","2.8.0-1","2.8.0-1ubuntu0.1~esm1"]}],"products":[{"vendor":"arm","product":"mbed_crypto"},{"vendor":"arm","product":"mbed_tls"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://tls.mbed.org/tech-updates/security-advisories","tags":["x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-12","tags":["x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NGDACU65MYZXXVPQP2EBHUJGOR4RWLVY/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A3GWQNONS7GRORXZJ7MOJFUEJ2ZJ4OUW/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18222"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A3GWQNONS7GRORXZJ7MOJFUEJ2ZJ4OUW/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NGDACU65MYZXXVPQP2EBHUJGOR4RWLVY/"},{"url":"https://github.com/advisories/GHSA-fpgh-hvp5-cqc2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-18222","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-18222","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0053.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25952","tags":["report"]},{"url":"https://tls.mbed.org/tech-updates/releases/mbedtls-2.16.3-and-2.7.12-released","tags":["web"]},{"url":"https://tls.mbed.org/tech-updates/releases/mbedtls-2.16.4-and-2.7.13-released","tags":["web"]},{"url":"https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-10","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-18222","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-18222","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-18222","description":"The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.","status":"published","published":"2020-01-23T00:00:00Z","modified":"2024-08-05T01:47:14.077Z","updated_at":"2026-11-02T14:32:23.803059Z"}],"euvd":[{"id":"EUVD-2019-8022","description":"The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.","status":"published","published":"2020-01-23T00:00:00Z","modified":"2024-08-05T01:47:14Z","updated_at":"2026-11-03T02:40:28.860423Z"}],"ghsa":[{"id":"GHSA-fpgh-hvp5-cqc2","title":"The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1...","description":"The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.","status":"published","published":"2022-05-24T17:07:11Z","modified":"2023-01-27T05:02:59Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-203"],"updated_at":"2026-11-02T14:42:08.614878Z"}],"nvd":[{"id":"CVE-2019-18222","description":"The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.","status":"published","published":"2020-01-23T17:15:11.893Z","modified":"2026-06-17T02:24:37.513Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:05:42.416368Z"}],"osv":[{"id":"ALPINE-CVE-2019-18222","description":"The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.","status":"published","published":"2020-01-23T17:15:11.893Z","modified":"2026-09-21T06:17:52.501549827Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"CVE-2019-18222","description":"The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.","status":"published","published":"2020-01-23T17:15:11.893Z","modified":"2026-10-24T10:31:04.861726535Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-18222","description":"The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.","status":"published","published":"2020-01-23T17:15:11.893Z","modified":"2026-09-21T07:03:10.059314193Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"JLSEC-2025-199","title":"The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1...","description":"The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.","status":"published","published":"2025-11-21T15:59:04.054Z","modified":"2026-07-23T22:30:18.541544664Z","cvss":[{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","level":"low"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"UBUNTU-CVE-2019-18222","description":"The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.","status":"published","published":"2020-01-23T17:15:00Z","modified":"2026-04-22T12:13:44.331091Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"DLA-3249-1","title":"mbedtls - security update","status":"published","published":"2022-12-26T00:00:00Z","modified":"2026-03-09T01:22:32.743764Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2020-0053","title":"Updated mbedtls packages fix security vulnerabilities","description":"This update from mbedTLS 2.16.2 to mbedTLS 2.16.4 fixes several security\nvulnerabilities, among which:\n\nThe deterministic ECDSA calculation reused the scheme's HMAC-DRBG to\nimplement blinding. Because of this for the same key and message the\nsame blinding value was generated. This reduced the effectiveness of the\ncountermeasure and leaked information about the private key through side\nchannels (CVE-2019-16910).\n\nFix side channel vulnerability in ECDSA. Our bignum implementation is not\nconstant time/constant trace, so side channel attacks can retrieve the blinded\nvalue, factor it (as it is smaller than RSA keys and not guaranteed to have\nonly large prime factors), and then, by brute force, recover the key\n(CVE-2019-18222).\n\nSee release notes for details.\n","status":"published","published":"2020-01-28T07:52:40Z","modified":"2026-04-16T04:44:30.311134355Z","updated_at":"2026-11-02T15:49:41.151324Z"}]}}