CVE-2019-16910: arm mbed_crypto
Vulnerability summary
CVE-2019-16910 is a medium (CVSS 5.3) vulnerability in arm mbed_crypto. EPSS estimates a 1.77% chance of exploitation in the next 30 days, higher than 77.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 26-09-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. (For Mbed TLS, the fix is also available in versions 2.7.12 and 2.16.3.)
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.77%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.77% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Arm2 products
- mbed_crypto< 2.0.0
- mbed_tls< 2.7.12 | ≥ 2.8.0, < 2.16.3
Debian2 products
- mbedtls< 2.16.3-1
- debian_linuxEOL10.0
Alpine1 product
- mbedtls< 2.16.3-r0
Fedoraproject1 product
- fedoraEOL29 | 30 | 31
Trustedfirmware1 product
- mbed_tls≥ 2.17.0, < 2.19.0
Ubuntu1 product
- mbedtlsAll versions (No fix recorded)
6 vendors · 8 products
References
11 links- tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-10Vendor AdvisoryREPORT
