CVE-2020-25659

mediumpriority · track · 25EPSS 0.025 · 84 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

2.46% (84th) EPSS

CVSS 4.3 · medium

Is it mine?

47 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedpython-cryptography-0:3.2.1-4.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1608
Fixedpython-cryptography-debugsource-0:3.2.1-4.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1608
Fixedpython-cryptography-debugsource-0:3.2.1-4.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1608
Fixedpython-cryptography-debugsource-0:3.2.1-4.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1608
Fixedpython-cryptography-debugsource-0:3.2.1-4.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1608
Fixedpython3-cryptography-0:3.2.1-4.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1608
Fixedpython3-cryptography-0:3.2.1-4.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1608
Fixedpython3-cryptography-0:3.2.1-4.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1608
Fixedpython3-cryptography-0:3.2.1-4.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1608
Fixedpython3-cryptography-debuginfo-0:3.2.1-4.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1608
Fixedpython3-cryptography-debuginfo-0:3.2.1-4.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1608
Fixedpython3-cryptography-debuginfo-0:3.2.1-4.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1608
Fixedpython3-cryptography-debuginfo-0:3.2.1-4.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1608

cvss

Technical severity, 0–10. One row per scoring source.

5.9

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04.3mediumAV:N/AC:M/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 8.6 · impact 2.9

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 2.2 · impact 3.6

v3.15.9mediumAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · OSV

v3.15.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · Red Hat Product Security US

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-385USCWE-385USCWE-385USCWE-385US

affected products (47)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Avaya Aura Experience Portalall versionscert_bundDEcpe:/a:avaya:aura_experience_portal:-
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
Juniper JUNOSall versionscert_bundDEcpe:/o:juniper:junos:-
Open Source Pythonall versionscert_bundDEcpe:/a:python:python:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Dell PowerScale OneFS≤ OneFS <9.4.0.18cert_bundDE
IBM QRadar SIEM< 7.5.0 UP8cert_bundDE
IBM Spectrum Protect Plus< 10.1.17cert_bundDE
n/a python-cryptography≤ python-cryptography 3.2enisa_euvdEU
Novell Inc. OpenSUSE Leap≤ 15.4fstec_bduRU
Novell Inc. OpenSUSE Leap≤ 15.3fstec_bduRU
Novell Inc. OpenSUSE Leap≤ 15.2fstec_bduRU
Oracle Corp. Oracle Communications Cloud Native Core Network Function Cloud Native Environment≤ 1.10.0fstec_bduRU
Python Cryptographic Authority cryptography≤ 3.2fstec_bduRU
Red Hat Inc. Ansible Automation Platform≤ 1.2fstec_bduRU
Red Hat Inc. Ansible Tower≤ 3fstec_bduRU

showing 20 of 47

advisories (4)

Vendor and ecosystem advisories describing this.

RHSA-2021:1608Red Hat Security Advisory: python-cryptography security, bug fix, and enhancement update2021-05-18csaf · redhat_csafUS
An update for python-cryptography is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2023-0557python-cryptography: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2020-11-04csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in python-cryptography ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
GHSA-hggm-jpg3-v476RSA decryption vulnerable to Bleichenbacher timing vulnerability2020-10-27ghsa · osvUS
RSA decryption was vulnerable to Bleichenbacher timing vulnerabilities, which would impact people using RSA decryption in online scenarios. This is fixed in cryptography 3.2.
PYSEC-2021-622021-01-11vendor · osvUS
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund redhat_csaf NVD CVE.org MITRE

published 2021-01-11modified 2026-06-17

references (37)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan