CVE-2020-0601

Community ground truth

Field notes & remediation

Verdicts are the quick signal — notes are the evidence and fixes behind them.

• ▲0▼
  Field note · Sam WhitakerCurated

  Microsoft Windows CryptoAPI Spoofing Vulnerability — Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall. Listed in the CISA KEV catalog (added 2021-11-03) — confirmed exploited in the wild, not theoretical. FIRST EPSS puts the chance of exploitation in the next 30 days at ~89%. Treat it as real and prioritize remediation over triage.

• ▲0▼
  Remediation · Mara OkonkwoCurated

  Required action for Microsoft Windows: Apply updates per vendor instructions. CISA set a federal remediation due date of 2022-05-03. After patching, verify the vulnerable path is no longer reachable before closing the finding.