Medium severity · published Jan 19, 2021
CVE-2020-20950
Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26
5.9
CVSS
0.9%
EPSS
No
On KEV
Description
Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26. The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
Microchip Libraries For Applications · Microchip
through 2018-11-26 · source: NVD
PK
Public Key Cryptography Standards #1 · Ietf
1.5 · source: NVD
Affected product
PK
Public Key Cryptography Standards #1
Ietf
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-20950
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-20950
Technical Description
http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf
Technical Description
https://bi-zone.medium.com/silence-will-fall-or-how-it-can-take-2-years-to-get-your-vuln-registered-e6134846f5bb
Product
https://www.microchip.com/mplab/microchip-libraries-for-applications
More from Public Key Cryptography Standards #1
5.9
CVE-2020-20949
Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924)