CVE:CVE-2020-20949
CNNVD:CNNVD-202101-1615
Stmicroelectronics Stm32 Crypto Library Package是美国Stmicroelectronics公司的一个为Stm32系列微控制器提供加密功能的代码库。
Stmicroelectronics Stm32 Crypto Library Package 存在加密问题漏洞，攻击者可以使用Bleichenbacher的oracle攻击通过使用易受攻击的库对服务器进行连续查询来解密加密的密文，从而导致远程信息泄露。以下产品及型号收到影响：使用该库的 STM32Cube 系列产品。
solution:Upgrade st stm32cubef0 to a higher version than -; Upgrade st stm32cubef1 to a higher version than -; Upgrade st stm32cubef2 to a higher version than -; Upgrade st stm32cubef3 to a higher version than -; Upgrade st stm32cubef4 to a higher version than -; Upgrade st stm32cubef7 to a higher version than -; Upgrade st stm32cubeg0 to a higher version than -; Upgrade st stm32cubeg4 to a higher version than -; Upgrade st stm32cubeh7 to a higher version than -; Upgrade st stm32cubeide to a higher version than -; Upgrade st stm32cubel0 to a higher version than -; Upgrade st stm32cubel1 to a higher version than -; Upgrade st stm32cubel4 to a higher version than -; Upgrade st stm32cubel4+ to a higher version than -; Upgrade st stm32cubel5 to a higher version than -; Upgrade st stm32cubemonitor to a higher version than -; Upgrade st stm32cubemp1 to a higher version than -; Upgrade st stm32cubemx to a higher version than -; Upgrade st stm32cubeprogrammer to a higher version than -; Upgrade st stm32cubewb to a higher version than -; Upgrade st stm32cubewl to a higher version than -; Upgrade ietf public_key_cryptography_standards_#1 to a higher version than 1.5,and avoid the version 1.5