CVE-2019-16910

Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. (For Mbed TLS, the fix is also available in versions 2.7.12 and 2.16.3.)

• https://github.com/ARMmbed/mbedtls/commit/298a43a77ec0ed2c19a8c924ddd8571ef3e65dfdPatch
• https://github.com/ARMmbed/mbedtls/commit/33f66ba6fd234114aa37f0209dac031bb2870a9bPatch
• https://lists.debian.org/debian-lts-announce/2022/12/msg00036.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CGSKQSGR5SOBRBXDSSPTCDSBB5K3GMPF/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSFFOROD6IVLADZHNJC2LPDV7FQRP7XB/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEHHH2DOBXB25CAU3Q6E66X723VAYTB5/Mailing List, Third Party Advisory
• https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-10Vendor Advisory
• https://github.com/ARMmbed/mbedtls/commit/298a43a77ec0ed2c19a8c924ddd8571ef3e65dfdPatch
• https://github.com/ARMmbed/mbedtls/commit/33f66ba6fd234114aa37f0209dac031bb2870a9bPatch
• https://lists.debian.org/debian-lts-announce/2022/12/msg00036.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CGSKQSGR5SOBRBXDSSPTCDSBB5K3GMPF/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSFFOROD6IVLADZHNJC2LPDV7FQRP7XB/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEHHH2DOBXB25CAU3Q6E66X723VAYTB5/Mailing List, Third Party Advisory
• https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-10Vendor Advisory

Published

Sep 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16905OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled wi…7.8
• CVE-2019-16906An issue was discovered in the Infosysta "In-App & Desktop N…7.5
• CVE-2019-16907An issue was discovered in the Infosysta "In-App & Desktop N…5.3
• CVE-2019-16908An issue was discovered in the Infosysta "In-App & Desktop N…5.3
• CVE-2019-16909An issue was discovered in the Infosysta "In-App & Desktop N…4.3
• CVE-2019-1691A vulnerability in the detection engine of Cisco Firepower T…5.8
• CVE-2019-16913PC Protect Antivirus v4.14.31 installs by default to %PROGRA…7.8
• CVE-2019-16914An XSS issue was discovered in pfSense through 2.4.4-p3. In …6.1
• CVE-2019-16915An issue was discovered in pfSense through 2.4.4-p3. widgets…9.8
• CVE-2019-16916Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-16917WiKID Enterprise 2FA (two factor authentication) Enterprise …8.8
• CVE-2019-16919Harbor API has a Broken Access Control vulnerability. The vu…7.5