CVE-2019-19963: Medium severity wolfssl wolfmqtt vulnerability
Published Dec 24, 2019
·Updated
An issue was discovered in wolfSSL before 4.3.0 in a non-default configuration where DSA is enabled. DSA signing uses the BEEA algorithm during modular inversion of the nonce, leading to a side-channel attack against the nonce.
Affected Software
1 affected component
wolfSSL wolfssl<4.3.0
Remediation
Event History
Dec 24, 2019
CVE Published
via MITRE·11:03 PM
Data Sourced
via MITRE·11:03 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-19963.
2
What is the severity of CVE-2019-19963?
The severity of CVE-2019-19963 is medium.
3
What is the affected software?
The affected software is Wolfssl version up to but excluding 4.3.0.
4
How does the vulnerability in CVE-2019-19963 occur?
The vulnerability in CVE-2019-19963 occurs when DSA signing uses the BEEA algorithm during modular inversion of the nonce, leading to a side-channel attack against the nonce.
5
How can I fix the vulnerability in CVE-2019-19963?
To fix the vulnerability in CVE-2019-19963, you should update to version 4.3.0 or later of Wolfssl.