CVE-2020-1026

描述

A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library's Elliptic Curve Cryptography (ECC) implementation.An attacker could potentially abuse these bugs to learn information about a server's private ECC key (a key leakage attack) or craft an invalid ECDSA signature that nevertheless passes as valid.The security update addresses the vulnerability by fixing the bugs disclosed in the ECC implementation, aka `MSR JavaScript Cryptography Library Security Feature Bypass Vulnerability`.

如何修補 CVE-2020-1026

要修補 CVE-2020-1026,請將受影響套件升級到下列已修補版本。

• —升級至 1.5.8 或更新版本

CVE-2020-1026 正在被利用嗎?

低 — EPSS 為 2.5%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 1.5.8

CVSS 分數

參考連結(2)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-1026
• WEBportal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1026