PYSEC-2021-62

vendorUSosv

view advisory published 2021-01-11Licence: CC-BY-4.0

python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-25659US	medium5.9	2.46% (84th)	—	2021-01-11
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-hggm-jpg3-v476ADVISORY
https://github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472bWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan