Log in Start free

Vulnerability · Published Feb 5, 2024 · Assigned by redhat

CVE-2023-50781M2crypto: bleichenbacher timing attacks in the rsa decryption api - incomplete fix for cve-2020-25657

High 7.5

In plain English

A high-severity security flaw in m2crypto. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.1%top 33.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12m2cryptono fix listedDEBIAN-CVE-2023-50781
Debian:13m2crypto0.40.1-3DEBIAN-CVE-2023-50781
PyPIm2cryptono fix listedGHSA-944j-8ch6-rf6x
PyPIm2cryptono fix listedPYSEC-2026-1595
Ubuntu:22.04:LTSm2cryptono fix listedUBUNTU-CVE-2023-50781
Ubuntu:24.04:LTSm2cryptono fix listedUBUNTU-CVE-2023-50781
Ubuntu:25.10m2cryptono fix listedUBUNTU-CVE-2023-50781
Ubuntu:26.04:LTSm2cryptono fix listedUBUNTU-CVE-2023-50781

Affected products (as reported)

VendorProductVersions
m2crypto see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Update Infrastructure 4 for Cloud Providers see references
Red Hat Red Hat Virtualization 4 see references

Weakness: CWE-203 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References