CVE-2019-14318

CVE-2019-14318 describes a timing side-channel vulnerability in Crypto++ versions 8.3.0 and earlier, specifically impacting ECDSA signature generation. An attacker, local or remote, can exploit this non-constant time scalar multiplication to deduce the private key by measuring the duration of numerous signing operations. The vulnerability carries a CVSS score of 5.9 (Medium) due to its network attack vector and high impact on confidentiality, despite requiring high attack complexity. There is no evidence of active exploitation, public exploit code, or Metasploit/Nuclei modules, though it has garnered some community discussion, including mention of a "Minerva Attack" which relates to similar timing side-channels in cryptographic libraries.