CVE-2020-20950

Опубликовано: 19 янв. 2021

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26. The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.

Ссылки

http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf
Technical Description
Third Party Advisory
http://microchip.com
Product
https://bi-zone.medium.com/silence-will-fall-or-how-it-can-take-2-years-to-get-your-vuln-registered-e6134846f5bb
Technical Description
Third Party Advisory
https://www.microchip.com/mplab/microchip-libraries-for-applications
Product
http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf
Technical Description
Third Party Advisory
http://microchip.com
Product
https://bi-zone.medium.com/silence-will-fall-or-how-it-can-take-2-years-to-get-your-vuln-registered-e6134846f5bb
Technical Description
Third Party Advisory
https://www.microchip.com/mplab/microchip-libraries-for-applications
Product

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:ietf:public_key_cryptography_standards_\#1:1.5:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:a:microchip:microchip_libraries_for_applications:*:*:*:*:*:*:*:*

Версия до 2018-11-26 (включая)

Одно из

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

EPSS

Процентиль: 64%

0.00467

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-327

Связанные уязвимости

GHSA-vw76-vm27-jx3r

github

больше 3 лет назад