What’s Vulnerable › Vulnerabilities

CVE-2020-20949

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-01-20 · updated 2026-07-09
• Weakness: CWE-327

Description

Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.

Affected products

• IETF Public Key Cryptography Standards #1: 1.5
• Stm32Cubef0: all versions
• Stm32Cubef1: all versions
• Stm32Cubef2: all versions
• Stm32Cubef3: all versions
• Stm32Cubef4: all versions
• Stm32Cubef7: all versions
• Stm32Cubeg0: all versions
• Stm32Cubeg4: all versions
• Stm32Cubeh7: all versions
• Stm32Cubeide: all versions
• Stm32Cubel0: all versions
• Stm32Cubel1: all versions
• Stm32Cubel4: all versions
• Stm32Cubel4+: all versions
• Stm32Cubel5: all versions
• Stm32Cubemonitor: all versions
• Stm32Cubemp1: all versions
• Stm32Cubemx: all versions
• Stm32Cubeprogrammer: all versions
• Stm32Cubewb: all versions
• Stm32Cubewl: all versions

References

• http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf
• https://bi-zone.medium.com/silence-will-fall-or-how-it-can-take-2-years-to-get-your-vuln-registered-e6134846f5bb
• https://www.st.com/en/embedded-software/x-cube-cryptolib.html
• http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf
• https://bi-zone.medium.com/silence-will-fall-or-how-it-can-take-2-years-to-get-your-vuln-registered-e6134846f5bb
• https://www.st.com/en/embedded-software/x-cube-cryptolib.html

Get alerted when CVE-2020-20949 or the next vulnerability affects your stack