SB2021041626 - Multiple vulnerabilities in NSS component in F5OS and Traffix SDC
Published: April 16, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Cryptographic issues (CVE-ID: CVE-2020-6829)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to usage of wNAF point multiplication algorithm when performing EC scalar point multiplication, which leaked partial information about the nonce used during signature generation. A remote attacker can perform an electro-magnetic side-channel attack and recover the private key.
2) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2020-12400)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists in Mozilla NSS library in the way P-384 and P-521 curves are used in the generation of EDSA signatures, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key.
3) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2020-12401)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to usage of ECDSA signatures. A local user can perform a side channel attack and gain access to sensitive information.
4) Cryptographic issues (CVE-ID: CVE-2020-12402)
The vulnerability allows a remote attacker to recover the secret primes.
During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.