CVE-2020-15309 Information disclosure in n/a
Local attackers can exploit cache-timing side channels in wolfSSL to recover sensitive private key information when single precision is disabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15309?
CVE-2020-15309 is a high-severity vulnerability in Wolfssl Wolfssl, published on 21 Aug 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Local attackers can conduct a cache-timing attack against public key operations. These attackers may already have obtained sensitive information if the affected system has been used for private key operations (e.g., signing with a private key).
Weakness: CWE-362
Which versions are affected by CVE-2020-15309?
It affects 1 product.
Products include Wolfssl Wolfssl.
How do I fix CVE-2020-15309?
Upgrade to a fixed version.
Is CVE-2020-15309 being exploited?
There is no known exploitation of CVE-2020-15309 in the wild and no public exploit code.
Other vulnerabilities in Wolfssl Wolfssl
Sources
Also known as DEBIAN-CVE-2020-15309, GHSA-hrmr-g9x6-f5v8, UBUNTU-CVE-2020-15309.