CVE-2020-12400
First published: Mon Jul 06 2020(Updated: )
A side-channel flaw was found in NSS, in the way P-384 and P-521 curves are used in the generation of EDSA signatures, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/nspr | <0:4.25.0-2.el7_9 | 0:4.25.0-2.el7_9 |
| redhat/nss | <0:3.53.1-3.el7_9 | 0:3.53.1-3.el7_9 |
| redhat/nss-softokn | <0:3.53.1-6.el7_9 | 0:3.53.1-6.el7_9 |
| redhat/nss-util | <0:3.53.1-1.el7_9 | 0:3.53.1-1.el7_9 |
| redhat/nss | <0:3.53.1-17.el8_3 | 0:3.53.1-17.el8_3 |
| IBM Cloud Pak for Security (CP4S) | <=1.6.0.1 | |
| IBM Cloud Pak for Security (CP4S) | <=1.6.0.0 | |
| IBM Cloud Pak for Security (CP4S) | <=1.5.0.1 | |
| IBM Cloud Pak for Security (CP4S) | <=1.5.0.0 | |
| IBM Cloud Pak for Security (CP4S) | <=1.4.0.0 | |
| Mozilla Firefox | <80.0 | |
| Mozilla Firefox | <80.0 | |
| All of | ||
| Mozilla Firefox | =80 | |
| Google Android | ||
| Mozilla Firefox | <80 | 80 |
| redhat/nss | <3.55 | 3.55 |
Remedy
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://exchange.xforce.ibmcloud.com/vulnerabilities/186705
- https://www.ibm.com/support/pages/node/6453115 (Advisory)
- https://bugzilla.mozilla.org/show_bug.cgi?id=1623116
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-39/
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/
- https://lists.debian.org/debian-lts-announce/2023/02/msg00021.html
- https://www.mozilla.org/security/advisories/mfsa2020-36/
- https://www.mozilla.org/security/advisories/mfsa2020-39/
- https://access.redhat.com/security/cve/CVE-2020-6829
- https://hg.mozilla.org/projects/nss/rev/e55ab3145546ae3cf1333b43956a974675d2d25c
- https://hg.mozilla.org/projects/nss/rev/3f022d5eca5d3cd0e366a825a5681953d76299d0
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1862356
- https://access.redhat.com/errata/RHSA-2020:4076
- https://access.redhat.com/security/cve/cve-2020-12400
- https://access.redhat.com/errata/RHSA-2021:0538
- https://bugzilla.redhat.com/show_bug.cgi?id=1853983
- https://www.cve.org/CVERecord?id=CVE-2020-12400 https://nvd.nist.gov/vuln/detail/CVE-2020-12400 https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes
- https://access.redhat.com/security/cve/CVE-2020-12400
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is CVE-2020-12400?
CVE-2020-12400 is a vulnerability in Mozilla Network Security Services (NSS) that allows a local authenticated attacker to obtain sensitive information.
How does CVE-2020-12400 impact Mozilla Firefox?
CVE-2020-12400 could allow a local authenticated attacker to obtain sensitive information in Mozilla Firefox.
How can an attacker exploit CVE-2020-12400?
An attacker can exploit CVE-2020-12400 by leveraging a side-channel flaw in the way P-384 and P-521 curves are used in the generation of EDSA signatures.
What is the severity of CVE-2020-12400?
The severity of CVE-2020-12400 is medium, with a CVSS score of 4.4.
How can I fix CVE-2020-12400?
To fix CVE-2020-12400, it is recommended to update Mozilla Firefox to version 80 or apply the necessary patches provided by the vendor.
- collector/redhat-cve
- agent/type
- agent/last-modified-date
- collector/mozilla-advisory
- agent/software-canonical-lookup-request
- agent/first-publish-date
- agent/references
- agent/remedy
- agent/weakness
- agent/author
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-12400
- agent/software-canonical-lookup
- agent/event
- source/Mozilla
- agent/softwarecombine
- agent/description
- collector/nvd-index
- collector/ibm-support
- source/IBM
- agent/tags
- collector/mitre-cve
- source/MITRE
- package-manager/redhat
- vendor/mozilla
- canonical/mozilla firefox
- version/mozilla firefox/80
- vendor/google
- canonical/google android
- vendor/ibm
- canonical/ibm cloud pak for security (cp4s)
- version/ibm cloud pak for security (cp4s)/1.6.0.1
- version/ibm cloud pak for security (cp4s)/1.6.0.0
- version/ibm cloud pak for security (cp4s)/1.5.0.1
- version/ibm cloud pak for security (cp4s)/1.5.0.0
- version/ibm cloud pak for security (cp4s)/1.4.0.0