CVE-2020-20949

—

CVSS 3.1

5.9 medium

EPSS

<1%p58

Published

Jan 20, 2021 (Jan 20, 2021)

Modified

Jul 9, 2026

Description

Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.

Vendors: st ietf
Products: stm32cubef0, stm32cubef1, stm32cubef2, stm32cubef3, stm32cubef4, stm32cubef7, stm32cubeg0, stm32cubeg4, stm32cubeh7, stm32cubeide, stm32cubel0, stm32cubel1
Weakness: CWE-327
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news0 stories

No ingested article mentions this CVE yet.