CVE-2020-10059: UpdateHub Module Explicitly Disables TLS Verification
The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firmware images requiring valid signatures. However, there is no benefit to using DTLS without the peer checking. See NCC-ZEP-018 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-10059?
CVE-2020-10059 has a medium severity level due to its potential for a man-in-the-middle attack.
How do I fix CVE-2020-10059?
To mitigate CVE-2020-10059, update to the latest version of the Zephyr RTOS that ensures proper DTLS peer checking.
Which software versions are affected by CVE-2020-10059?
CVE-2020-10059 affects Zephyr RTOS versions 2.1.0 and 2.2.0.
What type of attack does CVE-2020-10059 allow?
CVE-2020-10059 allows for man-in-the-middle attacks due to disabled DTLS peer checking.
Is there any benefit to using DTLS without peer checking in CVE-2020-10059?
There is no benefit to using DTLS without peer checking as stated in the details of CVE-2020-10059.