What’s Vulnerable › Vulnerabilities

CVE-2020-20950

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-01-19 · updated 2026-07-09
• Weakness: CWE-327

Description

Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26. The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.

Affected products

• IETF Public Key Cryptography Standards #1: 1.5
• Microchip Libraries For Applications: through 2018-11-26

References

• http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf
• https://bi-zone.medium.com/silence-will-fall-or-how-it-can-take-2-years-to-get-your-vuln-registered-e6134846f5bb
• https://www.microchip.com/mplab/microchip-libraries-for-applications
• http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf
• https://bi-zone.medium.com/silence-will-fall-or-how-it-can-take-2-years-to-get-your-vuln-registered-e6134846f5bb
• https://www.microchip.com/mplab/microchip-libraries-for-applications

Get alerted when CVE-2020-20950 or the next vulnerability affects your stack