CVEvulnerability

CVE-2020-20949

5.9 MEDIUM Published 2021-01-20 Modified 2026-07-09 Official page ↗
Status
Modified
Published
2021-01-20
Last modified
2026-07-09
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-327

Description

Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.

Affected configurations

• st stm32cubef0 • st stm32cubef1 • st stm32cubef2 • st stm32cubef3 • st stm32cubef4 • st stm32cubef7 • st stm32cubeg0 • st stm32cubeg4 • st stm32cubeh7 • st stm32cubeide • st stm32cubel0 • st stm32cubel1 • st stm32cubel4 • st stm32cubel4\+ • st stm32cubel5 • st stm32cubemonitor • st stm32cubemp1 • st stm32cubemx • st stm32cubeprogrammer • st stm32cubewb • st stm32cubewl • ietf public key cryptography standards \#1 1.5

Related

Weakness · CWE (1)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References