NVD Vulnerability Detail

CVE-2020-20949

Summary	Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.
Publication Date	Jan. 21, 2021, 1:15 a.m.
Registration Date	Jan. 26, 2021, 10:40 a.m.
Last Update	Nov. 21, 2024, 2:12 p.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:ietf:public_key_cryptography_standards_\#1:1.5:::::::*

Related information, measures and tools

No	URL	タグ
1	http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf	Technical Description Third Party Advisory
2	http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf	Technical Description Third Party Advisory
3	http://st.com	Product
4	http://st.com	Product
5	http://x-cube-cryptolib.com	Broken Link
6	http://x-cube-cryptolib.com	Broken Link
7	https://bi-zone.medium.com/silence-will-fall-or-how-it-can-take-2-years-to-get-your-vuln-registered-e6134846f5bb	Technical Description Third Party Advisory
8	https://bi-zone.medium.com/silence-will-fall-or-how-it-can-take-2-years-to-get-your-vuln-registered-e6134846f5bb	Technical Description Third Party Advisory
9	https://www.st.com/en/embedded-software/x-cube-cryptolib.html	Third Party Advisory
10	https://www.st.com/en/embedded-software/x-cube-cryptolib.html	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-327	不完全、または危険な暗号アルゴリズムの使用	https://cwe.mitre.org/data/definitions/327.html

JVN Vulnerability Information

STM32Cube デバイスにおける暗号アルゴリズムの使用に関する脆弱性

Title	STM32Cube デバイスにおける暗号アルゴリズムの使用に関する脆弱性
Summary	STM32Cube (UM1924) デバイスには、暗号アルゴリズムの使用に関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Aug. 13, 2020, midnight
Registration Date	Oct. 8, 2021, 6:11 p.m.
Last Update	Oct. 8, 2021, 6:11 p.m.

Affected System

STMicroelectronics

STM32CubeF0

STM32CubeF1

STM32CubeF2

STM32CubeF3

STM32CubeF4

STM32CubeF7

STM32CubeG0

STM32CubeG4

STM32CubeH7

STM32CubeIDE

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-20949	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-20949
National Vulnerability Database (NVD)
2	CVE-2020-20949	https://nvd.nist.gov/vuln/detail/CVE-2020-20949

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-327	https://cwe.mitre.org/data/definitions/327.html

ベンダー情報

No	Name	URL
STMicroelectronics
1	STM32 cryptographic firmware library software expansion for STM32Cube	https://www.st.com/en/embedded-software/x-cube-cryptolib.html
2	Top Page	http://st.com

その他

No	Name	URL
関連文書
1	Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS #1	http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf
2	Silence Will Fall (Or How It Can Take 2 Years to Get Your Vuln Registered)	https://bi-zone.medium.com/silence-will-fall-or-how-it-can-take-2-years-to-get-your-vuln-registered-e6134846f5bb

Change Log

No	Changed Details	Date of change
1	[2021年10月08日] 掲載	Oct. 8, 2021, 6:11 p.m.