CVE-2020-36422

MEDIUM

Arm Mbed TLS < 2.23.0 - ECC Private Key Recovery via Side Channel

Title source: llm
STIX 2.1

Description

An issue was discovered in Arm Mbed TLS before 2.23.0. A side channel allows recovery of an ECC private key, related to mbedtls_ecp_check_pub_priv, mbedtls_pk_parse_key, mbedtls_pk_parse_keyfile, mbedtls_ecp_mul, and mbedtls_ecp_mul_restartable.

References (4)

Core 4
Core References
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
Issue Tracking, Patch, Third Party Advisory
https://bugs.gentoo.org/730752
Release Notes, Third Party Advisory
https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.7
Release Notes, Third Party Advisory
https://github.com/ARMmbed/mbedtls/releases/tag/v2.23.0

Scores

CVSS v3 5.3
EPSS 0.0034
EPSS Percentile 56.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-203
Status published
Products (2)
arm/mbed_tls < 2.16.7
debian/debian_linux 10.0
Published Jul 19, 2021
Tracked Since Feb 18, 2026