PT-2020-13760 · Unknown · Crypt::Perl

Adelapieo · Published 2020-06-07 · Updated 2020-06-15 · CVE-2020-13895

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Crypt::Perl versions prior to 0.32

Description The issue is related to the verification of ECDSA signatures. Specifically, when using the curve secp256r1 (prime256v1), the verification may fail when r and s are small and when s equals 1. This could potentially have security implications if an attacker attempts to exploit this behavior by using public r and s values to guess whether signature verification will fail.

Recommendations For versions prior to 0.32, update to version 0.32 or later to resolve the issue.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2020-13895

Affected Products

Crypt::Perl

References · 4

• https://github.com/FGasper/p5-Crypt-Perl/commit/f960ce75502acf7404187231a706672f8369acb2 · Patch
• https://osv.dev/vulnerability/CVE-2020-13895 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13895 · Security Note
• https://github.com/FGasper/p5-Crypt-Perl/issues/14 · Note