PT-2020-13658 · Python+5 · Python-Rsa+5

Adelapie · Published 2020-05-27 · Updated 2024-07-12 · CVE-2020-13757

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Python-RSA versions prior to 4.1

Description The issue concerns the decryption of ciphertext, where leading '0' bytes are ignored. This could potentially have security implications, such as helping an attacker infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior, like causing excessive memory allocation.

Recommendations For versions prior to 4.1, update to version 4.1 or later to resolve the issue.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

BDU:2025-03987

CVE-2020-13757

GHSA-537H-RV9Q-VVPH

MGASA-2020-0364

OPENSUSE-SU-2021:0901-1

OPENSUSE-SU-2021:2008-1

OPENSUSE-SU-2021_0901-1

OPENSUSE-SU-2021_2008-1

OPENSUSE-SU-2024:11269-1

OPENSUSE-SU-2024:14163-1

PYSEC-2020-99

RHSA-2020:3453

RHSA-2020:3541

SUSE-SU-2021:2008-1

SUSE-SU-2021:2237-1

SUSE-SU-2021:2253-1

SUSE-SU-2021_2008-1

SUSE-SU-2021_2237-1

SUSE-SU-2022:3287-1

USN-4478-1

USN-4478-2

Affected Products

Astra Linux

Debian

Linuxmint

Python-Rsa

Suse

Ubuntu

References · 48

• 🔥 https://github.com/sybrenstuvel/python-rsa/issues/146#issuecomment-641845667 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2KILTHBHNSDUCYV22ODLOKTICJJ7JQIQ · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-13757 · Security Note
• https://usn.ubuntu.com/4478-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-537h-rv9q-vvph · Vendor Advisory
• https://osv.dev/vulnerability/USN-4478-2 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0364 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11269-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ZYB65VNILRBTXL6EITQTH2PZPK7I23MW · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/ZYB65VNILRBTXL6EITQTH2PZPK7I23MW · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2253-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZYB65VNILRBTXL6EITQTH2PZPK7I23MW · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0364.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-13757 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2KILTHBHNSDUCYV22ODLOKTICJJ7JQIQ · Vendor Advisory