CVE-2020-20949
Summary
| CVE | CVE-2020-20949 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-01-20 16:15:14 UTC |
| Updated | 2026-07-09 00:16:53 UTC |
| Description | Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure. |
Risk And Classification
Primary CVSS: v3.1 5.9 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.009190000 probability, percentile 0.560600000 (date 2026-07-11)
Problem Types: CWE-327 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 2.0 | [email protected] | Primary | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:M/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ietf | Public Key Cryptography Standards 1 | 1.5 | All | All | All |
| Application | St | Stm32cubef0 | - | All | All | All |
| Application | St | Stm32cubef1 | - | All | All | All |
| Application | St | Stm32cubef2 | - | All | All | All |
| Application | St | Stm32cubef3 | - | All | All | All |
| Application | St | Stm32cubef4 | - | All | All | All |
| Application | St | Stm32cubef7 | - | All | All | All |
| Application | St | Stm32cubeg0 | - | All | All | All |
| Application | St | Stm32cubeg4 | - | All | All | All |
| Application | St | Stm32cubeh7 | - | All | All | All |
| Application | St | Stm32cubeide | - | All | All | All |
| Application | St | Stm32cubel0 | - | All | All | All |
| Application | St | Stm32cubel1 | - | All | All | All |
| Application | St | Stm32cubel4 | - | All | All | All |
| Application | St | Stm32cubel4 | - | All | All | All |
| Application | St | Stm32cubel5 | - | All | All | All |
| Application | St | Stm32cubemonitor | - | All | All | All |
| Application | St | Stm32cubemp1 | - | All | All | All |
| Application | St | Stm32cubemx | - | All | All | All |
| Application | St | Stm32cubeprogrammer | - | All | All | All |
| Application | St | Stm32cubewb | - | All | All | All |
| Application | St | Stm32cubewl | - | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| X-CUBE-CRYPTOLIB - STM32 cryptographic firmware library software expansion for STM32Cube (UM1924) - STMicroelectronics - STMicroelectronics | af854a3a-2127-422b-91ae-364da2661108 | www.st.com | Third Party Advisory |
| Silence Will Fall (Or How It Can Take 2 Years to Get Your Vuln Registered) | by BI.ZONE | Jan, 2021 | Medium | af854a3a-2127-422b-91ae-364da2661108 | bi-zone.medium.com | Technical Description, Third Party Advisory |
| archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf | af854a3a-2127-422b-91ae-364da2661108 | archiv.infsec.ethz.ch | Technical Description, Third Party Advisory |
| ST | MITRE | st.com | |
| x-cube-cryptolib.com | MITRE | x-cube-cryptolib.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.