CVE-2020-12399
nss: Timing attack on DSA signature generation
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.
NSS ha mostrado diferencias de sincronización cuando se llevan a cabo firmas DSA, que fue explotable y eventualmente podrÃa filtrar claves privadas. Esta vulnerabilidad afecta a Thunderbird versiones anteriores a 68.9.0, Firefox versiones anteriores a 77 y Firefox ESR versiones anteriores a 68.9
A flaw was found in the DSA signature generation function in nss. During the process of generating a DSA signature, the nonce value 'k' is not padded, exposing the bit length. Combined with other techniques, this can result in the recovery of the DSA private key. The highest threat from this vulnerability is to data confidentiality.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-04-28 CVE Reserved
- 2020-06-05 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-203: Observable Discrepancy
- CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://security.gentoo.org/glsa/202007-49 | 2022-01-04 | |
| https://usn.ubuntu.com/4421-1 | 2022-01-04 | |
| https://www.debian.org/security/2020/dsa-4726 | 2022-01-04 | |
| https://www.mozilla.org/security/advisories/mfsa2020-20 | 2022-01-04 | |
| https://www.mozilla.org/security/advisories/mfsa2020-21 | 2022-01-04 | |
| https://www.mozilla.org/security/advisories/mfsa2020-22 | 2022-01-04 | |
| https://access.redhat.com/security/cve/CVE-2020-12399 | 2020-08-03 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1826177 | 2020-08-03 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | < 77.0 Search vendor "Mozilla" for product "Firefox" and version " < 77.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | < 68.9.0 Search vendor "Mozilla" for product "Firefox Esr" and version " < 68.9.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Thunderbird Search vendor "Mozilla" for product "Thunderbird" | < 68.9.0 Search vendor "Mozilla" for product "Thunderbird" and version " < 68.9.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||