{"id":"CVE-2020-0601","aliases":["ALPINE-CVE-2020-0601","BELL-CVE-2020-0601","BIT-golang-2020-0601","EUVD-2020-2099","GHSA-82jc-cv6x-r223","GO-2022-0535"],"status":"published","title":"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic...","description":"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.89078,"percentile":0.99782,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-295"],"published":"2020-01-14T23:11:20Z","modified":"2026-11-03T06:31:39Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"pocgithub","id":"nissan-sudo/CVE-2020-0601","title":"nissan-sudo/CVE-2020-0601","date":"2020-01-14","url":"https://github.com/nissan-sudo/CVE-2020-0601"},{"source":"pocgithub","id":"0xxon/cve-2020-0601","title":"0xxon/cve-2020-0601","date":"2020-01-15","url":"https://github.com/0xxon/cve-2020-0601"},{"source":"pocgithub","id":"0xxon/cve-2020-0601-plugin","title":"0xxon/cve-2020-0601-plugin","date":"2020-01-15","url":"https://github.com/0xxon/cve-2020-0601-plugin"},{"source":"exploitdb","id":"EDB-47933","title":"Microsoft Windows - CryptoAPI (Crypt32.dll) Elliptic Curve Cryptography (ECC) Spoof Code-Signing Certificate","type":"local","platform":"windows","date":"2020-01-15","url":"https://www.exploit-db.com/exploits/47933"},{"source":"pocgithub","id":"JPurrier/CVE-2020-0601","title":"JPurrier/CVE-2020-0601","date":"2020-01-15","url":"https://github.com/JPurrier/CVE-2020-0601"},{"source":"pocgithub","id":"SherlockSec/CVE-2020-0601","title":"SherlockSec/CVE-2020-0601","date":"2020-01-15","url":"https://github.com/SherlockSec/CVE-2020-0601"},{"source":"pocgithub","id":"kudelskisecurity/chainoffools","title":"kudelskisecurity/chainoffools","date":"2020-01-15","url":"https://github.com/kudelskisecurity/chainoffools"},{"source":"pocgithub","id":"ly4k/CurveBall","title":"ly4k/CurveBall","date":"2020-01-15","url":"https://github.com/ly4k/CurveBall"},{"source":"pocgithub","id":"BlueTeamSteve/CVE-2020-0601","title":"BlueTeamSteve/CVE-2020-0601","date":"2020-01-16","url":"https://github.com/BlueTeamSteve/CVE-2020-0601"},{"source":"pocgithub","id":"RrUZi/Awesome-CVE-2020-0601","title":"RrUZi/Awesome-CVE-2020-0601","date":"2020-01-16","url":"https://github.com/RrUZi/Awesome-CVE-2020-0601"},{"source":"pocgithub","id":"saleemrashid/badecparams","title":"saleemrashid/badecparams","date":"2020-01-16","url":"https://github.com/saleemrashid/badecparams"},{"source":"pocgithub","id":"0xxon/cve-2020-0601-utils","title":"0xxon/cve-2020-0601-utils","date":"2020-01-17","url":"https://github.com/0xxon/cve-2020-0601-utils"},{"source":"pocgithub","id":"Doug-Moody/Windows10_Cumulative_Updates_PowerShell","title":"Doug-Moody/Windows10_Cumulative_Updates_PowerShell","date":"2020-01-17","url":"https://github.com/Doug-Moody/Windows10_Cumulative_Updates_PowerShell"},{"source":"pocgithub","id":"MarkusZehnle/CVE-2020-0601","title":"MarkusZehnle/CVE-2020-0601","date":"2020-01-17","url":"https://github.com/MarkusZehnle/CVE-2020-0601"},{"source":"pocgithub","id":"YoannDqr/CVE-2020-0601","title":"YoannDqr/CVE-2020-0601","date":"2020-01-17","url":"https://github.com/YoannDqr/CVE-2020-0601"},{"source":"pocgithub","id":"thimelp/cve-2020-0601-Perl","title":"thimelp/cve-2020-0601-Perl","date":"2020-01-18","url":"https://github.com/thimelp/cve-2020-0601-Perl"},{"source":"pocgithub","id":"IIICTECH/-CVE-2020-0601-ECC---EXPLOIT","title":"IIICTECH/-CVE-2020-0601-ECC---EXPLOIT","date":"2020-01-19","url":"https://github.com/IIICTECH/-CVE-2020-0601-ECC---EXPLOIT"},{"source":"pocgithub","id":"dlee35/curveball_lua","title":"dlee35/curveball_lua","date":"2020-01-19","url":"https://github.com/dlee35/curveball_lua"},{"source":"pocgithub","id":"Ash112121/CVE-2020-0601","title":"Ash112121/CVE-2020-0601","date":"2020-01-20","url":"https://github.com/Ash112121/CVE-2020-0601"},{"source":"pocgithub","id":"gentilkiwi/curveball","title":"gentilkiwi/curveball","date":"2020-01-20","url":"https://github.com/gentilkiwi/curveball"},{"source":"pocgithub","id":"Hans-MartinHannibalLauridsen/CurveBall","title":"Hans-MartinHannibalLauridsen/CurveBall","date":"2020-01-23","url":"https://github.com/Hans-MartinHannibalLauridsen/CurveBall"},{"source":"pocgithub","id":"apodlosky/PoC_CurveBall","title":"apodlosky/PoC_CurveBall","date":"2020-01-25","url":"https://github.com/apodlosky/PoC_CurveBall"},{"source":"pocgithub","id":"ioncodes/Curveball","title":"ioncodes/Curveball","date":"2020-01-28","url":"https://github.com/ioncodes/Curveball"},{"source":"pocgithub","id":"amlweems/gringotts","title":"amlweems/gringotts","date":"2020-01-29","url":"https://github.com/amlweems/gringotts"},{"source":"pocgithub","id":"talbeerysec/CurveBallDetection","title":"talbeerysec/CurveBallDetection","date":"2020-02-03","url":"https://github.com/talbeerysec/CurveBallDetection"},{"source":"pocgithub","id":"yanghaoi/CVE-2020-0601","title":"yanghaoi/CVE-2020-0601","date":"2020-02-03","url":"https://github.com/yanghaoi/CVE-2020-0601"}],"exploits_more":10,"fixes":[{"ecosystem":"Alpine:v3.11","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.12.16","1.13.7"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.12.16","1.13.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"1.12.0"},{"fixed":"1.12.16"},{"introduced":"1.13.0"},{"fixed":"1.13.7"}]}]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.12.16"},{"introduced":"1.13.0-0"},{"fixed":"1.13.7"}]}]}],"products":[{"vendor":"golang","product":"go"},{"vendor":"microsoft","product":"windows"},{"vendor":"microsoft","product":"windows 10 version 1903 for 32-bit systems"},{"vendor":"microsoft","product":"windows 10 version 1903 for arm64-based systems"},{"vendor":"microsoft","product":"windows 10 version 1903 for x64-based systems"},{"vendor":"microsoft","product":"windows 10 version 1909 for 32-bit systems"},{"vendor":"microsoft","product":"windows 10 version 1909 for arm64-based systems"},{"vendor":"microsoft","product":"windows 10 version 1909 for x64-based systems"},{"vendor":"microsoft","product":"windows server"},{"vendor":"microsoft","product":"windows server, version 1903 (server core installation)"},{"vendor":"microsoft","product":"windows server, version 1909 (server core installation)"},{"vendor":"microsoft","product":"windows_10_1507"},{"vendor":"microsoft","product":"windows_10_1607"},{"vendor":"microsoft","product":"windows_10_1709"},{"vendor":"microsoft","product":"windows_10_1803"},{"vendor":"microsoft","product":"windows_10_1809"},{"vendor":"microsoft","product":"windows_10_1903"},{"vendor":"microsoft","product":"windows_10_1909"},{"vendor":"microsoft","product":"windows_server_1803"},{"vendor":"microsoft","product":"windows_server_1903"},{"vendor":"microsoft","product":"windows_server_1909"},{"vendor":"microsoft","product":"windows_server_2016"},{"vendor":"microsoft","product":"windows_server_2019"}],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0601","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-0601","tags":["web"]},{"url":"https://github.com/advisories/GHSA-82jc-cv6x-r223"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-0601","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-0601","tags":["advisory"]},{"url":"https://go.dev/cl/215905","tags":["fix"]},{"url":"https://go.googlesource.com/go/+/953bc8f391a63adf00bac2515dba62abe8a1e2c2","tags":["fix"]},{"url":"https://go.dev/issue/36834","tags":["report"]},{"url":"https://groups.google.com/g/golang-announce/c/Hsw4mHYc470/m/WJeW5wguEgAJ","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-0601","description":"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.","status":"published","published":"2020-01-14T23:11:20Z","modified":"2025-10-21T23:35:53.978Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:36:00.280422Z"}],"euvd":[{"id":"EUVD-2020-2099","description":"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.","status":"published","published":"2020-01-14T23:11:20Z","modified":"2025-10-21T23:35:53Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T20:31:24.816637Z"}],"ghsa":[{"id":"GHSA-82jc-cv6x-r223","title":"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic...","description":"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.","status":"published","published":"2022-05-24T17:06:15Z","modified":"2025-10-22T00:31:50Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:04:04.176931Z"}],"kev":[{"id":"CVE-2020-0601","title":"Microsoft Windows CryptoAPI Spoofing Vulnerability","description":"Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.","cwes":["CWE-295"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2020-0601","description":"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.","status":"published","published":"2020-01-14T23:15:30.207Z","modified":"2026-06-17T02:46:08.127Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:05:52.385274Z"}],"osv":[{"id":"ALPINE-CVE-2020-0601","description":"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.","status":"published","published":"2020-01-14T23:15:30.207Z","modified":"2026-11-03T06:31:39.095928669Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T07:18:23.800469Z"},{"id":"BELL-CVE-2020-0601","title":"CVE-2020-0601 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:10.20876Z","modified":"2026-01-26T09:49:44.0167Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2020-0601","description":"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.","status":"published","published":"2020-01-14T23:15:30.207Z","modified":"2026-10-24T10:30:25.268411008Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:13.492058Z"},{"id":"BIT-golang-2020-0601","description":"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.","status":"published","published":"2024-03-06T11:08:38.203Z","modified":"2026-09-08T08:45:13.416944923Z","updated_at":"2026-11-02T15:28:30.70064Z"},{"id":"GO-2022-0535","title":"Certificate validation bypass on Windows in crypto/x509","description":"A Windows vulnerability allows attackers to spoof valid certificate chains when the system root store is in use.\n\nA workaround is present in Go 1.12.6+ and Go 1.13.7+, but affected users should additionally install the Windows security update to protect their system.\n\nSee https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-0601 for details on the Windows vulnerability.","status":"published","published":"2022-08-01T22:21:17Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}