CVE-2019-13629
MEDIUM EPSS 65.4%
Published Oct 3, 20196y ago · Modified Jun 17, 20262w ago
5.9 CVSS 3.1
Published Oct 3, 2019 6y ago
Last Modified Jun 17, 2026 2w ago
Description
MatrixSSL 4.2.1 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or a remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because crypto/pubkey/ecc_math.c scalar multiplication leaks the bit length of the scalar.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None
Threat Intelligence
EPSS Exploit Probability
65.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 2
CWE-203
CWE-327
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| matrixssl | matrixssl | * | ≤4.2.1 |
References 4
- openwall.com http://www.openwall.com/lists/oss-security/2019/10/02/2
- eprint.iacr.org https://eprint.iacr.org/2011/232.pdf
- minerva.crocs.fi.muni.cz https://minerva.crocs.fi.muni.cz/
- tches.iacr.org https://tches.iacr.org/index.php/TCHES/article/view/7337
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.