CVE-2020-25659: Medium severity python-cryptography vulnerability
A flaw was found in python-cryptography, where it is vulnerable to Bleichenbacher timing attacks. This flaw allows an attacker, via the RSA decryption API, to decrypt parts of the ciphertext encrypted with RSA. The highest threat from this vulnerability is to confidentiality.
Other sources
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.
python-cryptography is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.
— Red Hat
RSA decryption was vulnerable to Bleichenbacher timing vulnerabilities, which would impact people using RSA decryption in online scenarios. This is fixed in cryptography 3.2.
— GitHub
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this python-cryptography vulnerability?
The vulnerability ID for this python-cryptography vulnerability is CVE-2020-25659.
What is the severity rating of CVE-2020-25659?
The severity rating of CVE-2020-25659 is medium with a value of 5.9.
How does the vulnerability impact confidentiality?
The vulnerability impacts confidentiality as an attacker can decrypt parts of the ciphertext.
Which software versions of python-cryptography are affected by CVE-2020-25659?
Versions up to and excluding 3.2 of python-cryptography are affected by CVE-2020-25659.
Where can I find more information about CVE-2020-25659?
You can find more information about CVE-2020-25659 at the following references: [GitHub](https://github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b), [Red Hat](https://access.redhat.com/support/policy/updates/cloudforms), [Cryptography.io](https://cryptography.io/en/latest/changelog.html#v3-2)