What is the CVSS score of CVE-2019-14318?

CVE-2019-14318 has a CVSS 3.0 base score of 5.9 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 3.2%.

Is there a public PoC exploit available for CVE-2019-14318?

Yes, a public proof-of-concept exploit is available for CVE-2019-14318. Prioritise patching immediately. EPSS: 3.2%.

Is there a patch available for CVE-2019-14318?

Yes, a patch is available for CVE-2019-14318. Update the affected software to the latest version immediately.

Crypto CVE-2019-14318

MEDIUM

Communication Channel Errors (CWE-417)

2019-07-30 cve@mitre.org

Information Disclosure Crypto

5.9

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Jul 30, 2019 - 17:15 nvd

MEDIUM 5.9

DescriptionNVD

Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because scalar multiplication in ecp.cpp (prime field curves, small leakage) and algebra.cpp (binary field curves, large leakage) is not constant time and leaks the bit length of the scalar among other information.

AnalysisAI

Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-417. Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because scalar multiplication in ecp.cpp (prime field curves, small leakage) and algebra.cpp (binary field curves, large leakage) is not constant time and leaks the bit length of the scalar among other information. Affected products include: Cryptopp Crypto\+\+.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.