CVE-2020-10941

Опубликовано: 24 мар. 2020

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usage during an import.

Ссылки

https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5JPE2HFBDJF3UBT6Q4VWLKNKCVCMX25J/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WD6OSOLLAR2AVPJAMGUKWRXN6477IHHV/
Mailing List
Third Party Advisory
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-02
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5JPE2HFBDJF3UBT6Q4VWLKNKCVCMX25J/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WD6OSOLLAR2AVPJAMGUKWRXN6477IHHV/
Mailing List
Third Party Advisory
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-02
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:arm:mbed_crypto:*:*:*:*:*:*:*:*

Версия до 3.1.0 (исключая)

cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*

Версия до 2.16.5 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 74%

0.0163

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2020-10941

CVSS3: 5.9

ubuntu

больше 6 лет назад

Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usage during an import.

CVE-2020-10941

msrc

11 месяцев назад

Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usage during an import.

CVE-2020-10941

CVSS3: 5.9

debian

больше 6 лет назад

Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive inform ...

GHSA-3qrr-m24q-j9qm

CVSS3: 5.9

github

около 4 лет назад

Arm Mbed TLS before 2.6.15 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usage during an import.

BDU:2020-02674

CVSS3: 5.9

fstec

больше 6 лет назад

Уязвимость реализации протоколов TLS и SSL программного обеспечения Mbed TLS, связанная с непринятием мер по шифрованию защищаемых данных, позволяющая нарушителю раскрыть закрытый ключ RSA

EPSS

Процентиль: 74%

0.0163

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

NVD-CWE-noinfo