4.4

CVE-2020-12402: debian debian_linux Observable Discrepancy

CVSS: 4.4v3.1MediumModified
AliasesALPINE-CVE-2020-12402SUSE-SU-2020:1850-1UBUNTU-CVE-2020-12402
Published 09-07-2020Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2020-12402 is a medium (CVSS 4.4) Observable Discrepancy vulnerability in debian debian_linux. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.5% of scored vulnerabilities.

Overall risk
18/100
0100
Low · default modelHow is this calculated?
CVSS score
4.4/10
010
Medium · v3.1 (NVD)
EPSS score
0.34%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 15 · Related 10
DLA-2266-1DLA-2388-1DSA-4726-1OPENSUSE-SU-2020:0983-1OPENSUSE-SU-2020:1017-1OPENSUSE-SU-2024:10600-1

Timeline

  1. 09-07-2020
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.34%

Chance of exploitation in the next 30 days

Percentile

26%

Versus all other CVEs

30-day change

0.00 pp

From 0.34% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.34%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse8 products
  • mozilla-nss&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 3.53.1-3.45.1
  • mozilla-nss&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 3.53.1-3.45.1
  • mozilla-nss&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 3.53.1-3.45.1
  • mozilla-nss&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 3.53.1-3.45.1
  • mozilla-nss&distro=SUSE Linux Enterprise Module for Server Applications 15 SP1< 3.53.1-3.45.1
Opensuse3 products
  • leapEOL15.1 | 15.2
  • mozilla-nss&distro=openSUSE Leap 15.1< 3.53.1-lp151.2.26.1
  • mozilla-nss&distro=openSUSE Leap 15.2< 3.53.1-lp152.2.4.1
Debian2 products
Alpine1 product
  • nss< 3.53.1-r0
Fedoraproject1 product
Mozilla1 product
  • firefox≥ unspecified, < 78 | < 78.0
Ubuntu1 product
  • nss< 2:3.28.4-0ubuntu0.16.04.12 | < 2:3.35-2ubuntu2.9 | < 2:3.49.1-1ubuntu1.2 | < 2:3.28.4-0ubuntu0.14.04.5+esm6

7 vendors · 17 products

References

26 links
Show all 26 references