CVE-2019-14317 Weak cryptography in n/a
Remote attackers can recover private keys from biased DSA nonces in wolfSSL, compromising cryptographic security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-14317?
CVE-2019-14317 is a medium-severity vulnerability in Wolfssl Wolfssl, published on 11 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
wolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as CyaSSL) generate biased DSA nonces. This allows a remote attacker to compute the long term private key from several hundred DSA signatures via a lattice attack. The issue occurs because dsa.c fixes two bits of the generated nonces.
Weakness: CWE-331
Which versions are affected by CVE-2019-14317?
It affects 1 product.
Products include Wolfssl Wolfssl.
How do I fix CVE-2019-14317?
Upgrade to a fixed version.
Is CVE-2019-14317 being exploited?
There is no known exploitation of CVE-2019-14317 in the wild and no public exploit code.
Other vulnerabilities in Wolfssl Wolfssl
Sources
Also known as DEBIAN-CVE-2019-14317, GHSA-3w65-mh9h-3g82, UBUNTU-CVE-2019-14317.