CVE-2020-10941: 
Mbed TLS vulnerability analysis and mitigation

CVE-2020-10941 affects Arm Mbed TLS versions before 2.16.5. The vulnerability was discovered and disclosed on March 24, 2020. This security flaw allows attackers to obtain sensitive information, specifically RSA private keys, by measuring cache usage during an import operation (NVD, MITRE).

The vulnerability has a CVSS 3.1 Base Score of 5.9 (Medium severity). The attack vector is Network-based, with High attack complexity, requiring No privileges or user interaction. The scope is Unchanged, with High confidentiality impact but No impact on integrity or availability. The complete vector string is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (Ubuntu).

The primary impact of this vulnerability is the potential exposure of RSA private keys through cache-based side-channel attacks. This could lead to the compromise of encrypted communications and sensitive data protected by the affected RSA keys (NVD).

The vulnerability has been fixed in Mbed TLS version 2.16.5 and later releases. Multiple distributions have released security updates, including Debian with version 2.16.9-0~deb10u1 and Fedora with version 2.16.7 (Debian LTS, Fedora).