Vulnerability in nss package: CVE-2020-12402
Summary
CVE-2020-12402: During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. Affects nss versions < 3.53.1-r0. Fixed in 3.53.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The nss package is a cryptographic library that provides support for SSL/TLS protocols, as well as certificate handling and cryptographic algorithms. It is commonly used in various applications and products built on top of it. However, a vulnerability has been discovered in versions prior to 3.53.1-r0, which could lead to the recovery of secret primes during RSA key generation. This vulnerability affects Firefox versions prior to 78, although an unmodified Firefox browser is not affected.
Vulnerability Detail
The vulnerability (CVE-2020-12402) arises from the use of a variation of the Binary Extended Euclidean Algorithm in the bignum implementations during RSA key generation. This algorithm introduces input-dependent flow, making it susceptible to electromagnetic-based side channel attacks. An attacker with the ability to perform such attacks can record traces that can be used to recover the secret primes. While an unmodified Firefox browser is not affected, products built on top of it may be vulnerable.
How To Fix
Minimum fixed version
3.53.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nssTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users are advised to ensure that they are using an unmodified version of the Firefox browser, as it is not affected by this vulnerability.
Conclusion
In conclusion, the nss package prior to version 3.53.1-r0 is vulnerable to CVE-2020-12402, which can lead to the recovery of secret primes during RSA key generation. While an unmodified Firefox browser is not affected, products built on top of it may be vulnerable. It is recommended to update the nss package to the fixed version and keep all software up to date to mitigate potential risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nss →
FAQ
Versions prior to 3.53.1-r0 of the nss package are affected.
No, an unmodified Firefox browser is not affected by this vulnerability.
There are no known exploits for this vulnerability at the moment.
Yes, this vulnerability can be exploited remotely by an attacker with the ability to perform electromagnetic-based side channel attacks.
There is no evidence of this vulnerability being actively exploited at the moment.
Related vulnerabilities
Recent vulnerabilities recorded for nss.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
