PT-2021-10561 · Microchip · Microchip Libraries For Applications

Published 2021-01-19 · Updated 2021-09-08 · CVE-2020-20950

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Microchip Libraries for Applications versions up to 2018-11-26

Description: The issue allows for Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure. This is due to a vulnerability in PKCS #1 v1.5 padding for RSA.

Recommendations: For versions up to 2018-11-26, consider updating to a version released after 2018-11-26 to resolve the issue. As a temporary workaround, restrict access to the vulnerable library to minimize the risk of exploitation.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2020-20950

Affected Products

Microchip Libraries For Applications

References · 8

• https://osv.dev/vulnerability/CVE-2020-20950 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-20950 · Security Note
• http://microchip.com · Note
• https://bi-zone.medium.com/silence-will-fall-or-how-it-can-take-2-years-to-get-your-vuln-registered-e6134846f5bb · Note
• https://t.me/cvenotify/8672 · Telegram Post
• https://microchip.com/mplab/microchip-libraries-for-applications · Note
• https://t.me/cibsecurity/22260 · Telegram Post
• http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf · Note