CVE-2019-19963 Information disclosure in n/a
A side-channel attack in wolfSSL's DSA signing allows nonce recovery in non-default configurations, potentially exposing private keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-19963?
CVE-2019-19963 is a medium-severity vulnerability in Wolfssl Wolfssl, published on 24 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in wolfSSL before 4.3.0 in a non-default configuration where DSA is enabled. DSA signing uses the BEEA algorithm during modular inversion of the nonce, leading to a side-channel attack against the nonce.
Which versions are affected by CVE-2019-19963?
It affects 1 product.
Products include Wolfssl Wolfssl.
How do I fix CVE-2019-19963?
Upgrade to a fixed version.
Is CVE-2019-19963 being exploited?
There is no known exploitation of CVE-2019-19963 in the wild and no public exploit code.
Other vulnerabilities in Wolfssl Wolfssl
Sources
Also known as DEBIAN-CVE-2019-19963, GHSA-gcqc-374g-rrqf, UBUNTU-CVE-2019-19963.