Missing Encryption of Sensitive Data in ARM mbed Crypto



| Updated: 2020-08-08
Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2020-10941
CWE-ID CWE-311
Exploitation vector Network
Public exploit N/A
Vulnerable software
 mbed Crypto
Universal components / Libraries / Libraries used by multiple products

Vendor ARM

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Missing Encryption of Sensitive Data

EUVDB-ID: #VU34604

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-10941

CWE-ID: CWE-311 - Missing Encryption of Sensitive Data

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Arm Mbed TLS before 2.6.15 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usage during an import.

Mitigation

Install update from vendor's website.

Vulnerable software versions

mbed Crypto: 3.0.0d0 - 3.0.1

CPE2.3 External links

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JPE2HFBDJF3UBT6Q4VWLKNKCVCMX25J/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WD6OSOLLAR2AVPJAMGUKWRXN6477IHHV/
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-02


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###