CVE-2020-13757: High severity python3-rfc3339 vulnerability
A flaw was found in the python-rsa package, where it does not explicitly check the ciphertext length against the key size and ignores the leading 0 bytes during the decryption of the ciphertext. This flaw allows an attacker to perform a ciphertext attack, leading to a denial of service. The highest threat from this vulnerability is to confidentiality.
Other sources
A vulnerability was found in Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
References: https://github.com/sybrenstuvel/python-rsa/issues/146 https://github.com/sybrenstuvel/python-rsa/issues/146#issuecomment-641845667
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-13757?
CVE-2020-13757 has been classified as a high severity vulnerability due to the potential for denial of service attacks.
How do I fix CVE-2020-13757?
To fix CVE-2020-13757, upgrade the python-rsa package to version 4.1 or later.
Which versions of python-rsa are affected by CVE-2020-13757?
Versions of python-rsa prior to 4.1 are affected by CVE-2020-13757.
Can CVE-2020-13757 be exploited remotely?
Yes, CVE-2020-13757 can be exploited remotely, allowing attackers to execute ciphertext attacks.
What impact does CVE-2020-13757 have on systems using python-rsa?
CVE-2020-13757 can lead to denial of service on systems utilizing the vulnerable python-rsa package.