Vulnerability · Published Nov 12, 2020 · Assigned by redhat
CVE-2020-25658
High 7.5
In plain English
A high-severity security flaw in python-rsa from Sybren A. Stüvel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.7%top 23.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-rsa | no fix listed | DEBIAN-CVE-2020-25658 |
| Debian:13 | python-rsa | no fix listed | DEBIAN-CVE-2020-25658 |
| Debian:14 | python-rsa | no fix listed | DEBIAN-CVE-2020-25658 |
| PyPI | rsa | 4.7 | GHSA-xrx6-fmxq-rjj2 |
| PyPI | rsa | 4.7 | PYSEC-2020-100 |
| Ubuntu:22.04:LTS | python-rsa | no fix listed | UBUNTU-CVE-2020-25658 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sybren A. Stüvel | python-rsa | after 3.0 (inclusive) |
Weakness: CWE-385 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25658 x_refsource_CONFIRM
- https://github.com/sybrenstuvel/python-rsa/issues/165 x_refsource_MISC
- FEDORA-2021-783a157adc vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-c1fef03e71 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-15e50503d6 vendor-advisory, x_refsource_FEDORA