Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-20949

Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.

Published

2021-01-20T16:15:14.007

Last Modified

2024-11-21T05:12:19.903

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.9 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-327
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application st stm32cubef0 - Yes
Application st stm32cubef1 - Yes
Application st stm32cubef2 - Yes
Application st stm32cubef3 - Yes
Application st stm32cubef4 - Yes
Application st stm32cubef7 - Yes
Application st stm32cubeg0 - Yes
Application st stm32cubeg4 - Yes
Application st stm32cubeh7 - Yes
Application st stm32cubeide - Yes
Application st stm32cubel0 - Yes
Application st stm32cubel1 - Yes
Application st stm32cubel4 - Yes
Application st stm32cubel4\+ - Yes
Application st stm32cubel5 - Yes
Application st stm32cubemonitor - Yes
Application st stm32cubemp1 - Yes
Application st stm32cubemx - Yes
Application st stm32cubeprogrammer - Yes
Application st stm32cubewb - Yes
Application st stm32cubewl - Yes
Application ietf public_key_cryptography_standards_\#1 1.5 Yes
References