8.8
CVE-2020-13895
- EPSS 0.71%
- Veröffentlicht 07.06.2020 01:15:10
- Zuletzt bearbeitet 21.11.2024 05:02:05
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginCrypt::Perl::ECDSA in the Crypt::Perl (aka p5-Crypt-Perl) module before 0.32 for Perl fails to verify correct ECDSA signatures when r and s are small and when s = 1. This happens when using the curve secp256r1 (prime256v1). This could conceivably have a security-relevant impact if an attacker wishes to use public r and s values when guessing whether signature verification will fail.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
P5-crypt-perl Project ≫ P5-crypt-perl SwPlatformperl Version < 0.32
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.71% | 0.486 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
CWE-347 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
https://github.com/FGasper/p5-Crypt-Perl/commit/f960ce75502acf7404187231a706672f8369acb2
https://github.com/FGasper/p5-Crypt-Perl/issues/14