Description: The fix for CVE-2020-25657 is not addressing the leakage in the RSA decryption. Because of the API design, the fix is generally not believed to be possible to be fully addressed. The issue can be mitigated by using a cryptographic backend that implements implicit rejection (Marvin workaround). Only applications that use RSA decryption with PKCS#1 v1.5 padding are affected.

References: https://gitlab.com/m2crypto/m2crypto/-/issues/342 https://people.redhat.com/~hkario/marvin/ https://github.com/openssl/openssl/pull/13817

All released versions of m2crypto are vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.

Upstream issue:

https://gitlab.com/m2crypto/m2crypto/-/issues/285

The m2crypto package (allowing to call OpenSSL functions from python scripts) incorrectly checked the result after calling various cryptographic decryption functions, allowing a malformed signature to be treated as a good signature rather than as an error. This issue affected the signature checks on DSA keys and ECDSA keys used with SSL/TLS.

There are also calls to DSAverify(), ECDSAverify(), DSAdoverify() and ECDSAdoverify() that seem to think that -1 means error, and then return the return code. But 0 is also an error case (see man DSAdoverify for example).

Relevant part of the code: (SWIG/dsa.i): 261 ret = DSAdoverify(vbuf, vlen, sig, dsa); 262 DSASIGfree(sig); 263 if (ret == -1) 264 PyErrSetString(dsaerr, ERRreasonerrorstring(ERRgeterror())); 265 return ret; SWIG/ec.i

248 ret = ECDSAdoverify(vbuf, vlen, sig, key); 249 ECDSASIGfree(sig); 250 if (ret == -1) 251 PyErrSetString(ecerr, ERRreasonerrorstring(ERRgeterror())); 252 return ret;

Occurences of other above mentioned functions: SWIG]# grep -r DSAverify | more dsa.i: if ((ret = DSAverify(0, vbuf, vlen, sbuf, slen, dsa)) == -1) ec.i: if ((ret = ECDSAverify(0, vbuf, vlen, sbuf, slen, key)) == -1)

SWIG]# grep -r ECDSAverify | more ec.i: if ((ret = ECDSAverify(0, vbuf, vlen, sbuf, slen, key)) == -1)

SWIG]# grep -r ECDSAdoverify | more ec.i: ret = ECDSAdoverify(vbuf, vlen, sig, key);

Please check also the following two issues:

The implementation of the verifyfinal() function in SWIG/evp.i calls OpenSSL's EVPVerifyFinal function (which was vulnerable to the recent OpenSSL's CVE-2008-5077 flaw) and 'only' returns its value.

M2Crypto/EVP.py seems to document that as only returning 0 for failure but it can also return -1 on failure.

All these issues are related with recent OpenSSL's CVE-2008-5077 flaw. Please see:

https://bugzilla.redhat.com/showbug.cgi?id=476671

for more information.

References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511515