CVE-2020-11683

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

A timing side channel was discovered in AT91bootstrap before 3.9.2. It can be exploited by attackers with physical access to forge CMAC values and subsequently boot arbitrary code on an affected system.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-203

Affected software

No affected versions have been published.

Timeline

Published: Sep 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-116849.1AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged CVE-2020-116857.5In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS.CVE-2020-116862.7In JetBrains TeamCity before 2019.1.4, a project administrator was able to retrieve some TeamCity server settings.CVE-2020-116877.5In JetBrains TeamCity before 2019.2.2, password values were shown in an unmasked format on several pages.CVE-2020-116887.5In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session.CVE-2020-116896.5In JetBrains TeamCity before 2019.2.1, a user without appropriate permissions was able to import settings from the settings.kts file.CVE-2020-11697.8<p>An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory. An attacker who successfull CVE-2020-116909.8In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases.CVE-2020-116917.5In JetBrains Hub before 2020.1.12099, content spoofing in the Hub OAuth error message was possible.CVE-2020-116922.7In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators.CVE-2020-116937.5JetBrains YouTrack before 2020.1.659 was vulnerable to DoS that could be caused by attaching a malformed TIFF file to an issue.CVE-2020-116947.5In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. This is fixed in 2019.2.6 and 201