Bug 28145

Summary:	crypto++ security issue CVE-2019-14318
Product:	Mageia	Reporter:	Zombie Ryushu <zombie_ryushu>
Component:	Security	Assignee:	Mageia Bug Squad <bugsquad>
Status:	RESOLVED DUPLICATE	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal
Version:	Cauldron
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	https://nvd.nist.gov/vuln/detail/CVE-2019-14318
Whiteboard:
Source RPM:	libcryptopp-8.2.0-2.mga8.src.rpm	CVE:	CVE-2019-14318
Status comment:

Description Zombie Ryushu 2021-01-17 13:28:08 CET

Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because scalar multiplication in ecp.cpp (prime field curves, small leakage) and algebra.cpp (binary field curves, large leakage) is not constant time and leaks the bit length of the scalar among other information.

Zombie Ryushu 2021-01-17 13:28:22 CET

CVE: (none) => CVE-2019-14318

Comment 1 David Walser 2021-01-17 17:47:12 CET

Already reported and FIXED!!!

*** This bug has been marked as a duplicate of bug 25759 ***

Status: NEW => RESOLVED
Resolution: (none) => DUPLICATE