8.1

CVE-2020-0601

Warning

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

Data is provided by the National Vulnerability Database (NVD)
Microsoft ≫ Windows 10 1507 Version- HwPlatformx64
Microsoft ≫ Windows 10 1507 Version- HwPlatformx86
Microsoft ≫ Windows 10 1607 Version- HwPlatformx64
Microsoft ≫ Windows 10 1607 Version- HwPlatformx86
Microsoft ≫ Windows 10 1709 Version- HwPlatformarm64
Microsoft ≫ Windows 10 1709 Version- HwPlatformx64
Microsoft ≫ Windows 10 1709 Version- HwPlatformx86
Microsoft ≫ Windows 10 1803 Version- HwPlatformarm64
Microsoft ≫ Windows 10 1803 Version- HwPlatformx64
Microsoft ≫ Windows 10 1803 Version- HwPlatformx86
Microsoft ≫ Windows 10 1809 HwPlatformarm64
Microsoft ≫ Windows 10 1809 HwPlatformx64
Microsoft ≫ Windows 10 1809 HwPlatformx86
Microsoft ≫ Windows 10 1903 Version- HwPlatformarm64
Microsoft ≫ Windows 10 1903 Version- HwPlatformx64
Microsoft ≫ Windows 10 1903 Version- HwPlatformx86
Microsoft ≫ Windows 10 1909 Version- HwPlatformarm64
Microsoft ≫ Windows 10 1909 Version- HwPlatformx64
Microsoft ≫ Windows 10 1909 Version- HwPlatformx86
Golang ≫ Go Version >= 1.12 < 1.12.16
   Microsoft ≫ Windows Version-
Golang ≫ Go Version >= 1.13 < 1.13.7
   Microsoft ≫ Windows Version-

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft Windows CryptoAPI Spoofing Vulnerability

Vulnerability

Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.

Description

Apply updates per vendor instructions.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 94.04% 0.999
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
nvd@nist.gov 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:P/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.