PT-2020-16151 · Python+3 · Python-Rsa+3

Tomato42 · Published 2020-11-12 · Updated 2025-01-23 · CVE-2020-25658

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions python-rsa (affected versions not specified)

Description It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-385

CWE-327

Related Identifiers

ALT-PU-2021-2514

ALT-PU-2025-1659

CVE-2020-25658

ECHO-28AB-14A8-957A

GHSA-XRX6-FMXQ-RJJ2

MGASA-2021-0456

OPENSUSE-SU-2022_3932-1

OPENSUSE-SU-2024:11269-1

OPENSUSE-SU-2024:14163-1

PYSEC-2020-100

RHSA-2020:5634

RHSA-2021:0637

RHSA-2022:1716

SUSE-SU-2022:3932-1

SUSE-SU-2022_3932-1

SUSE-SU-2023:0648-1

SUSE-SU-2023_0648-1

Affected Products

Alt Linux

Debian

Suse

Python-Rsa

References · 42

• 🔥 https://github.com/sybrenstuvel/python-rsa/issues/165 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-25658 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25658 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QY4PJWTYSOV7ZEYZVMYIF6XRU73CY6O7 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-25658 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-25658 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APF364QJ2IYLPDNVFBOEJ24QP2WLVLJP · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25658 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11269-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2SAF67KDGSOHLVFTRDOHNEAFDRSSYIWA · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3932-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QY4PJWTYSOV7ZEYZVMYIF6XRU73CY6O7 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-25658 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25658 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14163-1 · Vendor Advisory