Windows CryptoAPI spoofing vulnerability [CVE-2020-0601]

Any software, including third-party non-Microsoft software, that relies on the Windows CertGetCertificateChain() function to determine if an X.509 certificate can be traced to a trusted root CA may incorrectly determine the trustworthiness of a certificate chain. 

CVE-2020-0601 is a serious vulnerability, because it can be exploited to undermine Public Key Infrastructure (PKI) trust.   PKI is a set of mechanisms that home users, businesses, and governments rely upon in a wide variety of ways.  The vulnerability permits an attacker to craft PKI certificates to spoof trusted identifies, such as individuals, web sites, software companies, service providers, or others.   Using a forged certificate, the attacker can (under certain conditions) gain the trust of users or services on vulnerable systems, and leverage that trust to compromise them.  

https://kb.cert.org/vuls/id/849224/

https://krebsonsecurity.com/2020/01/cryptic-rumblings-ahead-of-first-20…

https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/205…

Fun-fact: First time that NSA found a dangerous software flaw and alerted the firm — rather than weaponizing it