Use of a Broken or Risky Cryptographic Algorithm

Affecting nss package, versions <2:3.42.1-1+deb10u3

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm. During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. Note: An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.

Remediation

Upgrade nss to version or higher.

References

CVSS Score

4.4
medium severity
  • Attack Vector
    Local
  • Attack Complexity
    High
  • Privileges Required
    Low
  • User Interaction
    Required
  • Scope
    Unchanged
  • Confidentiality
    High
  • Integrity
    None
  • Availability
    None
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
CVE
CVE-2020-12402
CWE
CWE-327
Snyk ID
SNYK-DEBIAN10-NSS-572778
Disclosed
09 Jul, 2020
Published
19 Jun, 2020