| Package | Affected versions | Patched versions |
|---|---|---|
| mbed tls | < 2.28.2 | 2.28.2 |
| mbed tls | ≥ 3.0.0, < 3.3.0 | 3.3.0 |
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses (typically, an untrusted operating system attacking a secure enclave) can recover an RSA private key after observing the victim performing a single private-key operation, if the window size (MBEDTLS_MPI_WINDOW_SIZE) used for the exponentiation is 3 or smaller.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free