Description
Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| Windows | Microsoft / Windows | 10 for 32-bit Systems | affected |
| Windows | Microsoft / Windows | 10 for x64-based Systems | affected |
| Windows | Microsoft / Windows | 10 Version 1607 for 32-bit Systems | affected |
| Windows | Microsoft / Windows | 10 Version 1607 for x64-based Systems | affected |
| Windows | Microsoft / Windows | 10 Version 1709 for 32-bit Systems | affected |
| Windows | Microsoft / Windows | 10 Version 1709 for ARM64-based Systems | affected |
| Windows | Microsoft / Windows | 10 Version 1709 for x64-based Systems | affected |
| Windows | Microsoft / Windows | 10 Version 1803 for 32-bit Systems | affected |
| Windows | Microsoft / Windows | 10 Version 1803 for ARM64-based Systems | affected |
| Windows | Microsoft / Windows | 10 Version 1803 for x64-based Systems | affected |
| Windows | Microsoft / Windows | 10 Version 1809 for 32-bit Systems | affected |
| Windows | Microsoft / Windows | 10 Version 1809 for ARM64-based Systems | affected |
| Windows | Microsoft / Windows | 10 Version 1809 for x64-based Systems | affected |
| Windows 10 Version 1903 for 32-bit Systems | Microsoft / Windows 10 Version 1903 for 32-bit Systems | unspecified | affected |
| Windows 10 Version 1903 for ARM64-based Systems | Microsoft / Windows 10 Version 1903 for ARM64-based Systems | unspecified | affected |
| Windows 10 Version 1903 for x64-based Systems | Microsoft / Windows 10 Version 1903 for x64-based Systems | unspecified | affected |
| Windows 10 Version 1909 for 32-bit Systems | Microsoft / Windows 10 Version 1909 for 32-bit Systems | unspecified | affected |
| Windows 10 Version 1909 for ARM64-based Systems | Microsoft / Windows 10 Version 1909 for ARM64-based Systems | unspecified | affected |
| Windows 10 Version 1909 for x64-based Systems | Microsoft / Windows 10 Version 1909 for x64-based Systems | unspecified | affected |
| Windows Server | Microsoft / Windows Server | 2016 | affected |
| Windows Server | Microsoft / Windows Server | 2016 (Core installation) | affected |
| Windows Server | Microsoft / Windows Server | 2019 | affected |
| Windows Server | Microsoft / Windows Server | 2019 (Core installation) | affected |
| Windows Server | Microsoft / Windows Server | version 1803 (Core Installation) | affected |
| Windows Server, version 1903 (Server Core installation) | Microsoft / Windows Server, version 1903 (Server Core installation) | unspecified | affected |
| Windows Server, version 1909 (Server Core installation) | Microsoft / Windows Server, version 1909 (Server Core installation) | unspecified | affected |