Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2020-6829: Firefox <80 can leak private keys via signatures
CVE-2020-6829 · published 6 years ago
Summary
Firefox versions before 80 may reveal part of the secret number used to create digital signatures. By observing the computer's electromagnetic emissions when signatures are generated, an attacker could reconstruct the private key. Updating Firefox to version 80 or later resolves the issue.
What to do
- Update debian nss to version 2:3.55-1.
- Update mozilla firefox to version 80.0 or later.
- Update mozilla firefox_mobile to version 80.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | nss |
< 2:3.55-1 Fix: upgrade to 2:3.55-1
|
| Debian:12 | debian | nss |
< 2:3.55-1 Fix: upgrade to 2:3.55-1
|
| Debian:13 | debian | nss |
< 2:3.55-1 Fix: upgrade to 2:3.55-1
|
| Debian:14 | debian | nss |
< 2:3.55-1 Fix: upgrade to 2:3.55-1
|
| – | mozilla | firefox |
< 80.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:-:*:* |
| – | mozilla | firefox_mobile |
< 80.0 cpe:2.3:a:mozilla:firefox_mobile:*:*:*:*:*:android:*:* |
Original advisory text
When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation. Given an electro...
When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation. Given an electro-magnetic trace of a few signature generations, the private key could have been computed. This vulnerability affects Firefox < 80 and Firefox for Android < 80.
References
- https://security-tracker.debian.org/tracker/CVE-2020-6829 Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1631583 Permissions Required
- https://lists.debian.org/debian-lts-announce/2023/02/msg00021.html
- https://www.mozilla.org/security/advisories/mfsa2020-36/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-39/ Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published28 Oct 2020
Updated31 Oct 2026
First seen21 Aug 2026
Track software like this
Free during beta