Loading vulnerability…
ECDSA timing side channel in OpenSSL libcrypto
CVE-2019-1547 is a timing side-channel vulnerability in OpenSSL libcrypto ECDSA signature generation. When an application constructs an elliptic-curve group using explicit parameters that omit the cofactor, OpenSSL can fall back to non-side-channel-resistant code paths. This occurs even if the remaining parameters match a known named curve. An attacker able to measure a large number of signature-generation operations may recover the complete ECDSA private key. Affected releases are OpenSSL 1.1.1 through 1.1.1c, 1.1.0 through 1.1.0k, and 1.0.2 through 1.0.2s. OpenSSL libssl is unaffected because it does not use explicit EC parameters.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose the complete ECDSA signing private key, compromising its confidentiality. A recovered key can subsequently be used to forge signatures or impersonate the key holder wherever that key is trusted. The vulnerability does not itself provide code execution, privilege escalation, or service disruption.
If you can’t patch tonight, do this now.
Where application changes are possible, use named curves instead of explicit EC parameters, or ensure explicitly constructed EC groups include the correct cofactor. These changes avoid the missing-cofactor condition responsible for the vulnerable fallback. Applications using only libssl are not affected.
Patch, then assume compromise.
Install a supported OpenSSL release containing the fix or a vendor package with the fix backported. The first fixed releases in the affected branches were 1.1.1d, 1.1.0l, and 1.0.2t. The fix computes an omitted cofactor during EC_GROUP construction and adds checks on the supplied group order. Restart applications and services linked to the updated library, or reboot, to activate the fix. Account for vendor backports rather than relying solely on the upstream version number.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.