CVE-2020-35167

2022-07-1119:25:51

CWE-200

dell

www.cve.org

dell bsafe

crypto-c micro edition

observable timing discrepancy

CVSS3

4.8

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

AI Score

9.4

Confidence

High

EPSS

0.002

Percentile

54.4%

JSON

Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability.

CNA Affected

[
  {
    "product": "Dell BSAFE Crypto-C Micro Edition",
    "vendor": "Dell",
    "versions": [
      {
        "lessThan": "4.1.5 or 4.1.4.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities

www.oracle.com/security-alerts/cpujul2022.html