Information disclosure in Microsoft Research JavaScript Cryptography Library V1.4
CVE-2020-1026
A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library’s Elliptic Curve Cryptography (ECC) implementation.An attacker could potentially abuse these bugs to learn information about a server’s private ECC key (a key leakage attack) or craft an invalid ECDSA signature that nevertheless passes as valid.The security update addresses the vulnerability by fixing the bugs disclosed in the ECC implementation, aka 'MSR JavaScript Cryptography Library Security Feature Bypass Vulnerability'.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.026 (84.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 85th percentile — 84.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.026 · newest: 0.026 · change: 0.000
Affected products
- Microsoft Research JavaScript Cryptography Library V1.4 — versions unspecified
- Microsoft Research JavaScript Cryptography Library — versions 1.4
Weakness classification (CWE)
References
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1026 (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-1026?
- CVE-2020-1026 is a critical-severity vulnerability in Microsoft Research JavaScript Cryptography Library V1.4, classified under Information Disclosure. CVSS score: 9.8/10. Published 2020-04-15.
- How severe is CVE-2020-1026?
- Critical severity. CVSS v3 base score is 9.8 out of 10.