High
Security advisory
The ECDSA operation of the micro-ecc library 1.0 is vulnerable to simple power analysis attacks which allows an adversary to extract the private ECC key.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-27209
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:36 UTC · Revision 1
Source evidence
The ECDSA operation of the micro-ecc library 1.0 is vulnerable to simple power analysis attacks which allows an adversary to extract the private ECC key.
osv:CVE-2020-27209
Complete source record
{
"id": "b2e838a06f195b643afc022207df1f9b39ba08662760517feece212dafecb9f7",
"url": "https://osv.dev/vulnerability/CVE-2020-27209",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-27209",
"summary": "The ECDSA operation of the micro-ecc library 1.0 is vulnerable to simple power analysis attacks which allows an adversary to extract the private ECC key.",
"evidence": "osv:CVE-2020-27209",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-27209",
"aliases": [
"CVE-2020-27209"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/kmackay/micro-ecc",
"type": "GIT",
"events": [
{
"introduced": "d037ec89546fad14b5c4d5456c2e23a71e554966"
},
{
"last_affected": "d037ec89546fad14b5c4d5456c2e23a71e554966"
},
{
"fixed": "1b5f5cea5145c96dd8791b9b2c41424fc74c2172"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:micro-ecc_project:micro-ecc:1.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0"
},
{
"last_affected": "1.0"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "1b5f5cea5145c96dd8791b9b2c41424fc74c2172"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"1.0",
"v1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-27209.json",
"vanir_signatures": [
{
"id": "CVE-2020-27209-60598547",
"digest": {
"length": 1845,
"function_hash": "222699852159252611929325926074463076687"
},
"source": "https://github.com/kmackay/micro-ecc/commit/1b5f5cea5145c96dd8791b9b2c41424fc74c2172",
"target": {
"file": "uECC.c",
"function": "uECC_sign_with_k"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-27209-b31f0120",
"digest": {
"length": 834,
"function_hash": "249593009610380198680253538341254672925"
},
"source": "https://github.com/kmackay/micro-ecc/commit/1b5f5cea5145c96dd8791b9b2c41424fc74c2172",
"target": {
"file": "uECC.c",
"function": "bits2int"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-27209-d20a3de7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"305101433005125945202075426985025328958",
"82981267676307096887488090504005731521",
"334523047272041585545844686517141925718",
"13219967681721080572505711468151280759",
"139736703219472062835090805194574720541",
"322175786906837796354861910254680147535",
"139494997547063837982264738431661462491",
"140569503132040539094917951320904837683",
"124845876707839708836963364657185906542",
"186514073613650829788803628122917566552",
"91082451782934131651994864009462108059",
"71228014830550427819084389676258659648",
"305779910505877227543853235173718315715",
"83863216990940013339395728169779516447",
"259427288176910632657282464550222952273",
"114011282683818521246207162944723263280",
"285203304151542375514860935568997894598",
"244159355370071661642199647957797156413",
"247101306798905568468182249754245636472",
"62358630235011342321298773529477473345"
]
},
"source": "https://github.com/kmackay/micro-ecc/commit/1b5f5cea5145c96dd8791b9b2c41424fc74c2172",
"target": {
"file": "uECC.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-27209-da7f5c5c",
"digest": {
"length": 3062,
"function_hash": "262377679775173692717740381933240475678"
},
"source": "https://github.com/kmackay/micro-ecc/commit/1b5f5cea5145c96dd8791b9b2c41424fc74c2172",
"target": {
"file": "uECC.c",
"function": "uECC_verify"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:59:21Z"
}
}
],
"modified": "2026-10-20T13:59:21.943679247Z",
"provider": "osv",
"references": [
"https://eprint.iacr.org/2021/640",
"https://github.com/kmackay/micro-ecc/releases",
"https://www.aisec.fraunhofer.de/de/das-institut/wissenschaftliche-exzellenz/security-and-trust-in-open-source-security-tokens.html",
"https://www.aisec.fraunhofer.de/en/FirmwareProtection.html",
"https://github.com/kmackay/micro-ecc/commit/1b5f5cea5145c96dd8791b9b2c41424fc74c2172"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-27209",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388478,
"published_at": "2021-05-20T21:15:07.653+00:00"
}