CVE-2020-20950
MediumCVSS 5.9Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
A Bleichenbacher vulnerability in the PKCS #1 v1.5 padding implementation for RSA in Microchip Libraries for Applications (versions up to 2018-11-26) allows an attacker to decrypt encrypted ciphertext by making successive queries to the server, resulting in remote information disclosure.
Risk Assessment
The risk involves the potential decryption of confidential data transmitted using the library, which could lead to the leakage of sensitive information such as session keys or authentication credentials.
Recommendation
Immediately update the Microchip Libraries for Applications to a version newer than 2018-11-26 that includes a fix for the Bleichenbacher attack vulnerability.
Original NVD description (English source)
Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26. The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.