CVE-2020-12402

low-risk

Published 2020-07-09

During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.

Do I need to act?

0.10% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.4/10 Medium

LOCAL / HIGH complexity

Affected Products (5)

Firefox

Fedora

Leap

Debian Linux

Affected Vendors

Debian Mozilla Fedoraproject Opensuse

References (26)

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00016.html

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00018.html

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html

Issue Tracking https://bugzilla.mozilla.org/show_bug.cgi?id=1631597

Mailing List https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.gentoo.org/glsa/202007-10

Third Party Advisory https://usn.ubuntu.com/4417-1/

Third Party Advisory https://usn.ubuntu.com/4417-2/

Third Party Advisory https://www.debian.org/security/2020/dsa-4726

Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2020-24/

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00016.html

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00018.html

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html

Issue Tracking https://bugzilla.mozilla.org/show_bug.cgi?id=1631597

Mailing List https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

and 6 more references

/ 100

low-risk

Severity 11/34 · Low

Exploitability 0/34 · Minimal

Exposure 12/34 · Low