CVE-2020-12401: Medium severity ibm cognos analytics vulnerability
A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.
Other sources
A timing attacker against ECDSA signature generation is able to obtain information from the secret nonce measuring the time an ECDSA signature generation takes. Current NSS code path has a countermeasure to prevent this know attack since 2011. However it was found that said countermeasure could be completely bypassed. Different flaw from CVE-2020-6829.
— Red Hat
During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data.
Mozilla Network Security Services (NSS), as used in Mozilla Firefox could allow a local authenticated attacker to obtain sensitive information, caused by an ECDSA timing attack when ECDSA signatures are generated. An attacker could exploit this vulnerability to extract pirate keys and obtain sensitive information.
— IBM
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2020-12401?
CVE-2020-12401 is a vulnerability that allows an attacker to extract partial information about the ECDSA nonce during ECDSA signature generation.
How does CVE-2020-12401 affect Mozilla Firefox?
Mozilla Firefox version 80 is affected by CVE-2020-12401.
How does CVE-2020-12401 affect Google Android?
Google Android is affected by CVE-2020-12401.
What is the severity of CVE-2020-12401?
CVE-2020-12401 has a severity rating of medium, with a CVSS score of 4.4.
How can CVE-2020-12401 be fixed?
To fix CVE-2020-12401, it is recommended to update to Mozilla Firefox version 80 or apply the appropriate security patches released by the vendor.