CVE-2020-20949

Опубликовано: 20 янв. 2021

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.

Ссылки

http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf
Technical Description
Third Party Advisory
http://st.com
Product
http://x-cube-cryptolib.com
Broken Link
https://bi-zone.medium.com/silence-will-fall-or-how-it-can-take-2-years-to-get-your-vuln-registered-e6134846f5bb
Technical Description
Third Party Advisory
https://www.st.com/en/embedded-software/x-cube-cryptolib.html
Third Party Advisory
http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf
Technical Description
Third Party Advisory
http://st.com
Product
http://x-cube-cryptolib.com
Broken Link
https://bi-zone.medium.com/silence-will-fall-or-how-it-can-take-2-years-to-get-your-vuln-registered-e6134846f5bb
Technical Description
Third Party Advisory
https://www.st.com/en/embedded-software/x-cube-cryptolib.html
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:st:stm32cubef0:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubef1:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubef2:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubef3:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubef4:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubef7:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubeg0:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubeg4:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubeh7:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubeide:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubel0:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubel1:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubel4:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubel4\+:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubel5:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubemonitor:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubemp1:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubemx:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubeprogrammer:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubewb:-:*:*:*:*:*:*:*

cpe:2.3:a:st:stm32cubewl:-:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:a:ietf:public_key_cryptography_standards_\#1:1.5:*:*:*:*:*:*:*

EPSS

Процентиль: 67%

0.0054

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-327

Связанные уязвимости

GHSA-7p98-xcgc-gwhj

github

больше 3 лет назад