PT-2020-3617 · Mozilla+7 · Firefox For Android+8

Alejandro Cabrera Aldaya + 6 · Published 2020-06-29 · Updated 2024-12-12 · CVE-2020-12401

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 80 Firefox for Android versions prior to 80

Description The issue is related to the ECDSA signature generation process, where the removal of padding in the nonce leads to variable-time execution that depends on secret data. This could potentially allow an attacker to gain unauthorized access to protected information. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For Firefox versions prior to 80, update to version 80 or later to resolve the issue. For Firefox for Android versions prior to 80, update to version 80 or later to resolve the issue.

Exploit

Fix

Side Channel Attack

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-203

CWE-327

Related Identifiers

ALT-PU-2020-2482

ALT-PU-2020-2706

ALT-PU-2020-2932

ALT-PU-2020-3442

ALT-PU-2021-1367

ALT-PU-2021-2725

ALT-PU-2021-2881

ALT-PU-2021-3368

ALT-PU-2021-3369

ALT-PU-2022-1781

BDU:2020-03961

CESA-2020_4076

CESA-2021_0538

CVE-2020-12401

DLA-2388-1

DLA-3327-1

MGASA-2020-0318

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:11058-1

OPENSUSE-SU-2024:14572-1

RHSA-2020:4076

RHSA-2020_4076

RHSA-2021:0538

RHSA-2021_0538

RLSA-2021:0538

SUSE-RU-2021:14818-1

SUSE-RU-2021:3115-1

SUSE-RU-2021:3115-2

SUSE-RU-2021:3116-1

USN-4455-1

USN-4474-1

USN-4474-2

Affected Products

Alt Linux

Astra Linux

Centos

Firefox

Firefox For Android

Linuxmint

Red Hat

Rocky Linux

Ubuntu

References · 1953

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_jit_use_after_free.rb · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-26485 · Exploit
• 🔥 https://github.com/aleksejspopovs/cve-2020-16012 · Exploit
• 🔥 https://github.com/R0jhack/CVE-2020-6514 · Exploit
• 🔥 https://github.com/hasan-khalil/CVE-2020-6514 · Exploit
• 🔥 https://github.com/HassanAzze/CVE-2020-6514 · Exploit
• 🔥 https://github.com/rojhack/CVE-2020-6514 · Exploit
• 🔥❌ https://github.com/marcinguy/CVE-2020-15999 · Exploit, Deleted
• https://ubuntu.com/security/CVE-2020-15664 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12401 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2020-31 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-12401 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-RU-2021:14818-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-6829 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15670 · Vendor Advisory