Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-10401. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-546/ - https://www.veeam.com/kb3144 - http://packetstormsecurity.com/files/157529/Veeam-ONE-Agent-.NET-Deserialization.html
CVE ID: CVE-2020-10916 State: PUBLISHED Published: 2020-05-07T22:20:12 Last Updated: 2024-08-04T11:14:15.896Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: TP-Link Products: TL-WA855RE Problem Types: CWE-287 Description: This vulnerability allows network-adjacent attackers to escalate privileges on affected installations of TP-Link TL-WA855RE Firmware Ver: 855rev4-up-ver1-0-1-P1[20191213-rel60361] Wi-Fi extenders. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the first-time setup process. The issue results from the lack of proper validation on first-time
ific flaw exists within the first-time setup process. The issue results from the lack of proper validation on first-time setup requests. An attacker can leverage this vulnerability to reset the password for the Admin account and execute code in the context of the device. Was ZDI-CAN-10003. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-553/
CVE ID: CVE-2020-10917 State: PUBLISHED Published: 2020-07-22T22:45:18 Last Updated: 2024-08-04T11:14:15.693Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NEC Products: ESMPRO Manager Problem Types: CWE-502 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NEC ESMPRO Manager 6.42. Authentication is not required to exploit this vulnerability. The specific flaw exists within the RMI service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context o
esult in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10007. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-684/
CVE ID: CVE-2020-10918 State: PUBLISHED Published: 2020-07-23T15:35:18 Last Updated: 2024-08-04T11:14:15.682Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: C-MORE Products: HMI EA9 Problem Types: CWE-287 Description: This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authentication mechanism. The issue is due to insufficient authentication on post-authentication requests. An attacker can leverage this vulnerability to escalate privileges to resources normally
post-authentication requests. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from unauthenticated users. Was ZDI-CAN-10182. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-805/
CVE ID: CVE-2020-10919 State: PUBLISHED Published: 2020-07-23T15:35:18 Last Updated: 2024-08-04T11:14:15.726Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: C-MORE Products: HMI EA9 Problem Types: CWE-261 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. When transmitting passwords, the process encrypts them in a recoverable format. An attacker can leverage this vulnerability to disclose credentials, leading to fu
ncrypts them in a recoverable format. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-10185. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-806/
CVE ID: CVE-2020-10920 State: PUBLISHED Published: 2020-07-23T15:35:19 Last Updated: 2024-08-04T11:14:15.788Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: C-MORE Products: HMI EA9 Problem Types: CWE-306 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the control service, which listens on TCP port 9999 by default. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can levera
esults from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-10493. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-808/
CVE ID: CVE-2020-10921 State: PUBLISHED Published: 2020-07-23T15:35:19 Last Updated: 2024-08-04T11:14:15.689Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: C-MORE Products: HMI EA9 Problem Types: CWE-306 Description: This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to issue commands to the
allowing alterations to the system configuration. An attacker can leverage this vulnerability to issue commands to the physical equipment controlled by the device. Was ZDI-CAN-10482. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-807/
CVE ID: CVE-2020-10922 State: PUBLISHED Published: 2020-07-23T15:35:20 Last Updated: 2024-08-04T11:14:15.785Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: C-MORE Products: HMI EA9 Problem Types: CWE-20 Description: This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of proper input validation prior to further processing user requests. An attacker can leverage this vulnerability to create a den
input validation prior to further processing user requests. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-10527. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-809/
CVE ID: CVE-2020-10923 State: PUBLISHED Published: 2020-07-28T17:10:35 Last Updated: 2024-08-04T11:14:15.723Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: NETGEAR Products: R6700 Problem Types: CWE-305 Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000. A crafted UPnP message can be used to bypass authentication. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary co
o bypass authentication. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9642. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-703/
CVE ID: CVE-2020-10924 State: PUBLISHED Published: 2020-07-28T17:10:36 Last Updated: 2024-08-04T11:14:15.766Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: R6700 Problem Types: CWE-121 Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the UPnP service, which listens on TCP port 5000 by default. The issue results from the lack of proper validation of the length of user-supplied dat
ens on TCP port 5000 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9643. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-704/
CVE ID: CVE-2020-10925 State: PUBLISHED Published: 2020-07-28T17:10:36 Last Updated: 2024-08-04T11:14:15.990Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: R6700 Problem Types: CWE-295 Description: This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via HTTPS. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction w
the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9647. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-705/
CVE ID: CVE-2020-10926 State: PUBLISHED Published: 2020-07-28T17:10:36 Last Updated: 2024-08-04T11:14:15.678Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: R6700 Problem Types: CWE-494 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of firmware updates. The issue results from the lack of proper validation of the firmware image prior to performing an upgrade. An attacker can leverage this in conjunction with other vulnerabil
of the firmware image prior to performing an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9648. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-706/
CVE ID: CVE-2020-10927 State: PUBLISHED Published: 2020-07-28T17:10:37 Last Updated: 2024-08-04T11:14:15.689Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: R6700 Problem Types: CWE-327 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the encryption of firmware update images. The issue results from the use of an inappropriate encryption algorithm. An attacker can leverage this in conjunction with other vulnerabilities to execute code in t
riate encryption algorithm. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9649. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-707/
CVE ID: CVE-2020-10928 State: PUBLISHED Published: 2020-07-28T17:10:37 Last Updated: 2024-08-04T11:14:15.671Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: R6700 Problem Types: CWE-122 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can l
lidation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-9767. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-708/
CVE ID: CVE-2020-10929 State: PUBLISHED Published: 2020-07-28T17:10:38 Last Updated: 2024-08-04T11:21:12.968Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: R6700 Problem Types: CWE-680 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leve
lidation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-9768. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-709/
CVE ID: CVE-2020-10930 State: PUBLISHED Published: 2020-07-28T17:10:38 Last Updated: 2024-08-04T11:21:12.963Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: NETGEAR Products: R6700 Problem Types: CWE-284 Description: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of URLs. The issue results from the lack of proper routing of URLs. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-C
Ls. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-9618. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-711/
CVE ID: CVE-2020-10931 State: PUBLISHED Published: 2020-03-24T14:25:56 Last Updated: 2024-08-04T11:21:12.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to try_read_command_binary in memcached.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/memcached/memcached/issues/629 - https://github.com/memcached/memcached/commit/02c6a2b62ddcb6fa4569a591d3461a156a636305 - https://github.com/memcached/memcached/wiki/ReleaseNotes162
CVE ID: CVE-2020-10932 State: PUBLISHED Published: 2020-04-15T00:00:00 Last Updated: 2024-08-04T11:21:12.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Arm Mbed TLS before 2.16.6 and 2.7.x before 2.7.15. An attacker that can get precise enough side-channel measurements can recover the long-term ECDSA private key by (1) reconstructing the projective coordinate of the result of scalar multiplication by exploiting side channels in the conversion to affine coordinates; (2) using an attack described by Naccache, Smart, and Stern in 2003 to recover a few bits of the ephemeral scalar from those projective coordinates via several measurements; and (3) usin
3 to recover a few bits of the ephemeral scalar from those projective coordinates via several measurements; and (3) using a lattice attack to get from there to the long-term ECDSA private key used for the signatures. Typically an attacker would have sufficient access when attacking an SGX enclave and controlling the untrusted OS. Additional Analyst Notes: - CVE Program Container: References: - https://tls.mbed.org/tech-updates/security-advisories - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-04 - https://tls.mbed.org/tech-updates/releases/mbedtls-2.16.6-and-2.7.15-released - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora
eases/mbedtls-2.16.6-and-2.7.15-released - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCWN5HIF4CJ2LZTOMEBJ7Q4IMMV7ZU2V/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNOS2IIBH5WNJXZUV546PY7666DE7Y3L/ - https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
CVE ID: CVE-2020-10933 State: PUBLISHED Published: 2020-05-04T14:54:00 Last Updated: 2024-08-04T11:21:13.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter. Additional Analyst Notes: - CVE Program Container: References: - https://www.ruby-lang.org/en/news/2020/03/31/heap-exposure-in-socket-cve-2020-10933/ -
Program Container: References: - https://www.ruby-lang.org/en/news/2020/03/31/heap-exposure-in-socket-cve-2020-10933/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4TNVTT66VPRMX5UZYSDGSVRXKKDDDU5/ - https://security.netapp.com/advisory/ntap-20200625-0001/ - https://www.debian.org/security/2020/dsa-4721
CVE ID: CVE-2020-10934 State: PUBLISHED Published: 2020-03-24T14:55:03 Last Updated: 2024-08-04T11:21:12.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: Acyba AcyMailing before 6.9.2 mishandles file uploads by admins. Additional Analyst Notes: - CVE Program Container: References: - https://www.acyba.com/acymailing/68-acymailing-changelog.html?Itemid=329 - http://jvn.jp/en/jp/JVN56890693/index.html
CVE ID: CVE-2020-10935 State: PUBLISHED Published: 2020-04-20T19:47:17 Last Updated: 2024-08-04T11:21:12.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://blog.zulip.org/2020/04/01/zulip-server-2-1-3-security-release/ - https://www.coresecurity.com/advisories/zulip-account-takeover-stored-xss
CVE ID: CVE-2020-10936 State: PUBLISHED Published: 2020-05-27T17:38:01 Last Updated: 2024-08-04T11:21:12.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sympa before 6.2.56 allows privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://sysdream.com/news/lab/ - https://github.com/sympa-community/sympa/releases - https://sysdream.com/news/lab/2020-05-25-cve-2020-10936-sympa-privileges-escalation-to-root/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3J4NZLGAF4ZYK52XEBQDTBNHLGBEPXXN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3TMQ3C
TBNHLGBEPXXN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3TMQ3CORUOWARALACCBG2SBTIGZ5GY5/ - https://usn.ubuntu.com/4442-1/ - https://lists.debian.org/debian-lts-announce/2020/10/msg00012.html - https://www.debian.org/security/2020/dsa-4818
CVE ID: CVE-2020-10937 State: PUBLISHED Published: 2020-11-02T16:53:10 Last Updated: 2024-08-04T11:21:13.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in IPFS (aka go-ipfs) 0.4.23. An attacker can generate ephemeral identities (Sybils) and leverage the IPFS connection management reputation system to poison other nodes' routing tables, eclipsing the nodes that are the target of the attack from the rest of the network. Later versions, in particular go-ipfs 0.7, mitigate this. Additional Analyst Notes: - CVE Program Container: References: - https://blog.ipfs.io/2020-10-30-dht-hardening/ - https://graz.pure.elsevier.com/en/publications/total-eclipse-of-t
es: - https://blog.ipfs.io/2020-10-30-dht-hardening/ - https://graz.pure.elsevier.com/en/publications/total-eclipse-of-the-heart-disrupting-the-interplanetary-file-sys
CVE ID: CVE-2020-10938 State: PUBLISHED Published: 2020-03-24T15:28:05 Last Updated: 2024-08-04T11:21:12.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: GraphicsMagick before 1.3.35 has an integer overflow and resultant heap-based buffer overflow in HuffmanDecodeImage in magick/compress.c. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/graphicsmagick/code/ci/5b4dd7c6674140a115ec9424c8d19c6a458fac3e/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00049.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00051.html - https://lists.debian.org/debian-lts-announce/2020/04/msg00007.html - https://www.
urity-announce/2020-03/msg00051.html - https://lists.debian.org/debian-lts-announce/2020/04/msg00007.html - https://www.debian.org/security/2020/dsa-4675
CVE ID: CVE-2020-10939 State: PUBLISHED Published: 2020-03-27T19:57:07 Last Updated: 2024-08-04T11:21:12.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2020-012
CVE ID: CVE-2020-10940 State: PUBLISHED Published: 2020-03-27T20:02:59 Last Updated: 2024-08-04T11:21:13.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2020-013
CVE ID: CVE-2020-10941 State: PUBLISHED Published: 2020-03-24T00:00:00 Last Updated: 2024-08-04T11:21:13.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usage during an import. Additional Analyst Notes: - CVE Program Container: References: - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-02 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5JPE2HFBDJF3UBT6Q4VWLKNKCVCMX25J/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WD6OSO
WLKNKCVCMX25J/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WD6OSOLLAR2AVPJAMGUKWRXN6477IHHV/ - https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html