PT-2020-6703 · Pypi+9 · Python-Cryptography+9
Published
2020-10-25
·
Updated
2024-09-09
·
CVE-2020-25659
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
python-cryptography versions 3.2
Description
The issue is related to errors in RSA key management in the python-cryptography package for the Python programming language. It may allow a remote attacker to gain unauthorized access to protected information. The vulnerability is specifically related to Bleichenbacher timing attacks in the RSA decryption API, which can be exploited through timed processing of valid PKCS#1 v1.5 ciphertext. This could impact users of RSA decryption in online scenarios.
Recommendations
For python-cryptography version 3.2, update to a version where the RSA decryption vulnerability is fixed, as the current version is vulnerable to Bleichenbacher timing attacks. As a temporary workaround, consider restricting the use of the RSA decryption API to minimize the risk of exploitation.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Centos
Linuxmint
Red Hat
Rocky Linux
Suse
Ubuntu
Zvirt Node
Python-Cryptography