PT-2020-12815 · Wolfssl · Wolfssl

Alejandro Cabrera Aldaya + 2 · Published 2020-06-25 · Updated 2021-07-21 · CVE-2020-11735

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 4.4.0

Description The issue concerns the private-key operations in ecc.c, which do not use a constant-time modular inverse when mapping to affine coordinates. This is also known as a "projective coordinates leak."

Recommendations For versions prior to 4.4.0, update to version 4.4.0 or later to resolve the issue.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2020-11735

Affected Products

Wolfssl

References · 10

• https://github.com/wolfSSL/wolfssl/commit/1de07da61f0c8e9926dcbd68119f73230dae283f · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-11735 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-11735 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-11735 · Security Note
• https://ubuntu.com/security/CVE-2020-11735 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11735 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11735 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-11735 · Vendor Advisory
• https://github.com/wolfSSL/wolfssl/releases/tag/v4.4.0-stable · Note
• https://t.me/cvenotify/4642 · Telegram Post