Vulnerability · Published Jul 9, 2020 · Assigned by mozilla

CVE-2020-12402

Medium 4.4

In plain English

A medium-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)4.4Medium

Exploit odds (30 days)0.3%top 72.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.20	firefox	78.0-r0	ALPINE-CVE-2020-12402
Alpine:v3.21	firefox	78.0-r0	ALPINE-CVE-2020-12402
Alpine:v3.22	firefox	78.0-r0	ALPINE-CVE-2020-12402
Alpine:v3.23	firefox	78.0-r0	ALPINE-CVE-2020-12402
Alpine:v3.21	librewolf	78.0-r0	ALPINE-CVE-2020-12402
Alpine:v3.22	librewolf	78.0-r0	ALPINE-CVE-2020-12402
Alpine:v3.23	librewolf	78.0-r0	ALPINE-CVE-2020-12402
Alpine:v3.24	librewolf	78.0-r0	ALPINE-CVE-2020-12402
Alpine:v3.20	nss	3.53.1-r0	ALPINE-CVE-2020-12402
Alpine:v3.21	nss	3.53.1-r0	ALPINE-CVE-2020-12402
Alpine:v3.22	nss	3.53.1-r0	ALPINE-CVE-2020-12402
Alpine:v3.23	nss	3.53.1-r0	ALPINE-CVE-2020-12402
Alpine:v3.24	nss	3.53.1-r0	ALPINE-CVE-2020-12402
Debian:12	nss	2:3.53.1-1	DEBIAN-CVE-2020-12402
Debian:13	nss	2:3.53.1-1	DEBIAN-CVE-2020-12402
Debian:14	nss	2:3.53.1-1	DEBIAN-CVE-2020-12402
Rocky Linux:8	nspr	0:4.25.0-2.el8_2	RLSA-2020:3280

Affected products (as reported)

Vendor	Product	Versions
Mozilla	Firefox	unspecified – before 78

References

https://www.mozilla.org/security/advisories/mfsa2020-24/ x_refsource_MISC
https://bugzilla.mozilla.org/show_bug.cgi?id=1631597 x_refsource_MISC
openSUSE-SU-2020:0953 vendor-advisory, x_refsource_SUSE
openSUSE-SU-2020:0955 vendor-advisory, x_refsource_SUSE
USN-4417-1 vendor-advisory, x_refsource_UBUNTU
openSUSE-SU-2020:0983 vendor-advisory, x_refsource_SUSE
DSA-4726 vendor-advisory, x_refsource_DEBIAN
FEDORA-2020-3ef1937475 vendor-advisory, x_refsource_FEDORA
openSUSE-SU-2020:1017 vendor-advisory, x_refsource_SUSE
GLSA-202007-10 vendor-advisory, x_refsource_GENTOO
USN-4417-2 vendor-advisory, x_refsource_UBUNTU
FEDORA-2020-16741ac7ff vendor-advisory, x_refsource_FEDORA
[debian-lts-announce] 20200929 [SECURITY] [DLA 2388-1] nss security update mailing-list, x_refsource_MLIST