CVE-2020-12401: Medium severity ibm cognos analytics vulnerability

Published Jun 26, 2020
·
Updated

A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.

Other sources

A timing attacker against ECDSA signature generation is able to obtain information from the secret nonce measuring the time an ECDSA signature generation takes. Current NSS code path has a countermeasure to prevent this know attack since 2011. However it was found that said countermeasure could be completely bypassed. Different flaw from CVE-2020-6829.

Red Hat

During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data.

Mozilla Network Security Services (NSS), as used in Mozilla Firefox could allow a local authenticated attacker to obtain sensitive information, caused by an ECDSA timing attack when ECDSA signatures are generated. An attacker could exploit this vulnerability to extract pirate keys and obtain sensitive information.

IBM

Affected Software

13 affected componentsFixes available
redhat/nspr<0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
redhat/nss<0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
redhat/nss-softokn<0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
redhat/nss-util<0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
redhat/nss<0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
redhat/nss<3.55
3.55
IBM Cognos Analytics<=12.0.0-12.0.3
IBM Cognos Analytics<=11.2.0-11.2.4 FP4
All of the following
Mozilla Firefox=80
Google Android
Mozilla Firefox<80
80
Mozilla Firefox<80.0
Mozilla Firefox Android<80.0

Remediation

Information

This is a side channel attack which can used to exact pirate keys when ECDSA signatures are being generated. This attack is only feasible when the attacker is local to the machine or in certain cross-VM scenarios where the signature is being generated. Attacks over the network or via the internet are not feasible.

Event History

Jun 30, 2020
CVE Published
12:00 AM
Oct 8, 2020
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2020-12401?

CVE-2020-12401 is a vulnerability that allows an attacker to extract partial information about the ECDSA nonce during ECDSA signature generation.

2

How does CVE-2020-12401 affect Mozilla Firefox?

Mozilla Firefox version 80 is affected by CVE-2020-12401.

3

How does CVE-2020-12401 affect Google Android?

Google Android is affected by CVE-2020-12401.

4

What is the severity of CVE-2020-12401?

CVE-2020-12401 has a severity rating of medium, with a CVSS score of 4.4.

5

How can CVE-2020-12401 be fixed?

To fix CVE-2020-12401, it is recommended to update to Mozilla Firefox version 80 or apply the appropriate security patches released by the vendor.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203