CVE-2020-12401

Katalog CVE

CVSS 4.7 · Medium EPSS 0,33%

Kerentanan Observable Discrepancy pada mozilla firefox, mozilla firefox mobile. Skor CVSS 3.1 4.7 (Medium) menurut NVD.

Deskripsi (NVD)

During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Rincian

Terbit di NVD

8 Oktober 2020

Terakhir diubah

19 Agustus 2026

Status NVD

Modified

CVSS 3.1

4.7 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-203: Observable Discrepancy

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 23,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.mozilla.org/show_bug.cgi?id=1631573 issue tracking · permissions required · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2020-36/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2020-39/ advisory vendor
• https://lists.debian.org/debian-lts-announce/2023/02/msg00021.html