critical9.1
CVE-2022-26320
The Rambus SafeZone Basic Crypto Module before 10.4.0, as used in certain Fujifilm (formerly Fuji Xerox) devices before 2022-03-01, Canon imagePROGRAF and imag…
Impact
The Rambus SafeZone Basic Crypto Module before 10.4.0, as used in certain Fujifilm (formerly Fuji Xerox) devices before 2022-03-01, Canon imagePROGRAF and imageRUNNER devices through 2022-03-14, and potentially many other devices, generates RSA keys that can be broken with Fermat's factorization method. This allows efficient calculation of private RSA keys from the public key of a TLS certificate.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rambus | Safezone Basic Crypto Module | from 9.3.0 before 10.4.0 |
| Fujifilm | Apeos C7070 Firmware | before 1.1.7 |
| Fujifilm | Apeos C6570 Firmware | before 1.1.7 |
| Fujifilm | Apeos C5570 Firmware | before 1.1.7 |
| Fujifilm | Apeos C4570 Firmware | before 1.1.7 |
| Fujifilm | Apeos C3570 Firmware | before 1.1.7 |
| Fujifilm | Apeos C3070 Firmware | before 1.1.7 |
| Fujifilm | Apeos C7070 G Firmware | before 1.1.7 |
| Fujifilm | Apeos C6570 G Firmware | before 1.1.7 |
| Fujifilm | Apeos C5570 G Firmware | before 1.1.7 |
| Fujifilm | Apeos C4570 G Firmware | before 1.1.7 |
| Fujifilm | Apeos C3570 G Firmware | before 1.1.7 |
Weakness classification
References
- NVD record
- CVE.org record
- https://fermatattack.secvuln.info
- https://global.canon/en/support/security/index.html
- https://web.archive.org/web/20220922042721/https://safezoneswupdate.com/
- https://www.fujifilm.com/fbglobal/eng/company/news/notice/2022/0302_rsakey_announce.html
- https://www.rambus.com/security/response-center/advisories/rmbs-2021-01/
- https://fermatattack.secvuln.info
- https://global.canon/en/support/security/index.html
- https://safezoneswupdate.com
- https://www.fujifilm.com/fbglobal/eng/company/news/notice/2022/0302_rsakey_announce.html