Skip to content
OpenAdvisories
High · 8.1 Known exploited Public exploit CVE-2020-0601 BIT-golang-2020-0601EUVD-2020-2099GHSA-82jc-cv6x-r223GO-2022-0535

Certificate validation bypass on Windows in crypto/x509

Published Jan 14, 2020 · Updated Oct 21, 2025 · Assigned by microsoft

Vendor: Microsoft Product: Windows Product: Windows 10 Version 1903 for 32-bit Systems Product: Windows 10 Version 1903 for ARM64-based Systems Product: Windows 10 Version 1903 for x64-based Systems Product: Windows 10 Version 1909 for 32-bit Systems Product: Windows 10 Version 1909 for ARM64-based Systems Product: Windows 10 Version 1909 for x64-based Systems Product: Windows Server Product: Windows Server, version 1903 (Server Core installation) Product: Windows Server, version 1909 (Server Core installation) Package: containerd Package: stdlib Platform: Windows Ecosystem: Alpine Ecosystem: Go

Description

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

Affected products

VendorProductAffectedFixed
Microsoft Windows 10 Version 1803 for 32-bit Systems, 10 Version 1803 for x64-based Systems, 10 Version 1803 for ARM64-based Systems, 10 Version 1809 for 32-bit Systems, 10 Version 1809 for x64-based Systems, 10 Version 1809 for ARM64-based Systems, 10 Version 1709 for 32-bit Systems, 10 Version 1709 for x64-based S… —
Microsoft Windows Server version 1803 (Core Installation), 2019, 2019 (Core installation), 2016, 2016 (Core installation) —
Microsoft Windows 10 Version 1903 for 32-bit Systems unspecified —
Microsoft Windows 10 Version 1903 for x64-based Systems unspecified —
Microsoft Windows 10 Version 1903 for ARM64-based Systems unspecified —
Microsoft Windows Server, version 1903 (Server Core installation) unspecified —
Microsoft Windows 10 Version 1909 for 32-bit Systems unspecified —
Microsoft Windows 10 Version 1909 for x64-based Systems unspecified —
Microsoft Windows Server, version 1909 (Server Core installation) unspecified —
Microsoft Windows 10 Version 1909 for ARM64-based Systems unspecified —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 containerd 1.3.3-r0 —
Alpine v3.23 containerd 1.3.3-r0 —
Alpine v3.22 containerd 1.3.3-r0 —
Alpine v3.21 containerd 1.3.3-r0 —
Alpine v3.20 containerd 1.3.3-r0 —
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 containerd 1.3.3-r0 —
Alpine v3.18 containerd 1.3.3-r0 —
Alpine v3.17 containerd 1.3.3-r0 —
Alpine v3.16 containerd 1.3.3-r0 —
Alpine v3.15 containerd 1.3.3-r0 —
Alpine v3.14 containerd 1.3.3-r0 —
Alpine v3.13 containerd 1.3.3-r0 —
Alpine v3.12 containerd 1.3.3-r0 —
Alpine v3.11 containerd 1.3.3-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 35 repositories · most starred shown

  • ly4k/CurveBall ★ 890 · Jan 15, 2020

    PoC for CVE-2020-0601- Windows CryptoAPI (Crypt32.dll)

  • kudelskisecurity/chainoffools ★ 336 · Jan 15, 2020

    A PoC for CVE-2020-0601

  • gentilkiwi/curveball ★ 76 · Jan 20, 2020

    CVE-2020-0601 #curveball - Alternative Key Calculator

  • saleemrashid/badecparams ★ 66 · Jan 16, 2020

    Proof of Concept for CVE-2020-0601

  • 0xxon/cve-2020-0601 ★ 35 · Jan 15, 2020

    Zeek package to detect CVE-2020-0601

  • eastmountyxz/CVE-2020-0601-EXP ★ 30 · Feb 17, 2020

    这资源是作者复现微软签字证书漏洞CVE-2020-0601，结合相关资源及文章实现。推荐大家结合作者博客，理解ECC算法、Windows验证机制，并尝试自己复现可执行文件签名证书和HTTPS劫持的例子。作为网络安全初学者，自己确实很菜，但希望坚持下去，加油！

  • ioncodes/Curveball ★ 20 · Jan 28, 2020

    PoC for CVE-2020-0601 - CryptoAPI exploit

  • RrUZi/Awesome-CVE-2020-0601 ★ 5 · Jan 16, 2020

    😂An awesome curated list of repos for CVE-2020-0601.

  • 0xxon/cve-2020-0601-plugin ★ 5 · Jan 15, 2020

    Zeek package that uses OpenSSL to detect CVE-2020-0601 exploit attempts

  • IIICTECH/-CVE-2020-0601-ECC---EXPLOIT ★ 3 · Jan 19, 2020

    CurveBall (CVE-2020-0601) - PoC CVE-2020-0601, or commonly referred to as CurveBall, is a vulnerability in which the signature of certificates using elliptic curve cryptography (ECC) is not correctly…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Go stdlib < 1.12.16 · >= 1.13.0-0, < 1.13.7 1.12.16, 1.13.7 GO-2022-0535

Advisories 1

References