REDHAT-BUG-2254426: Medium severity OpenSSL OpenSSL vulnerability
Description: The fix for CVE-2020-25657 is not addressing the leakage in the RSA decryption. Because of the API design, the fix is generally not believed to be possible to be fully addressed. The issue can be mitigated by using a cryptographic backend that implements implicit rejection (Marvin workaround). Only applications that use RSA decryption with PKCS#1 v1.5 padding are affected.
References: https://gitlab.com/m2crypto/m2crypto/-/issues/342 https://people.redhat.com/~hkario/marvin/ https://github.com/openssl/openssl/pull/13817
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2254426?
The severity of REDHAT-BUG-2254426 is assessed to be high due to potential RSA decryption leakage.
How do I fix REDHAT-BUG-2254426?
Currently, there is no complete fix for REDHAT-BUG-2254426, but mitigation strategies should be employed, such as patching and updating to secure versions.
Which software is affected by REDHAT-BUG-2254426?
REDHAT-BUG-2254426 affects the OpenSSL and M2Crypto software packages.
Is it safe to use OpenSSL with REDHAT-BUG-2254426 vulnerability?
Using OpenSSL with REDHAT-BUG-2254426 is risky and should be done with caution until proper mitigations are applied.
What are the risks associated with REDHAT-BUG-2254426?
The risks of REDHAT-BUG-2254426 include potential data exposure and security breaches due to RSA decryption leakage.