GO-2022-0535Published
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious …
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2020-0601 · CVE overview and exploitation status
cve-program · CVE-2020-0601
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601
- http://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html
- http://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html
euvd · EUVD-2020-2099
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601
- http://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html
- http://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html
nvd · CVE-2020-0601
- http://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html
- http://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0601
osv · GO-2022-0535
Related changes
Linked by CVE identifier- Microsoft Windows CryptoAPI Spoofing Vulnerability · CISA KEV deadline · 3 May 2022
- Microsoft Windows CryptoAPI Spoofing Vulnerability · Added to CISA KEV · 3 Nov 2021