ghsa-xrx6-fmxq-rjj2
Vulnerability from github
Published
2021-04-30 17:35
Modified
2024-10-26 22:33
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
8.2 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
8.2 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Summary
Timing attacks in python-rsa
Details
It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA
{ "affected": [ { "package": { "ecosystem": "PyPI", "name": "rsa" }, "ranges": [ { "events": [ { "introduced": "2.1" }, { "fixed": "4.7" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2020-25658" ], "database_specific": { "cwe_ids": [ "CWE-327", "CWE-385" ], "github_reviewed": true, "github_reviewed_at": "2021-04-20T17:11:41Z", "nvd_published_at": "2020-11-12T14:15:00Z", "severity": "HIGH" }, "details": "It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA", "id": "GHSA-xrx6-fmxq-rjj2", "modified": "2024-10-26T22:33:21Z", "published": "2021-04-30T17:35:15Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25658" }, { "type": "WEB", "url": "https://github.com/sybrenstuvel/python-rsa/issues/165" }, { "type": "WEB", "url": "https://github.com/sybrenstuvel/python-rsa/commit/dae8ce0d85478e16f2368b2341632775313d41ed" }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2020-25658" }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889972" }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25658" }, { "type": "ADVISORY", "url": "https://github.com/advisories/GHSA-xrx6-fmxq-rjj2" }, { "type": "WEB", "url": "https://github.com/pypa/advisory-database/tree/main/vulns/rsa/PYSEC-2020-100.yaml" }, { "type": "PACKAGE", "url": "https://github.com/sybrenstuvel/python-rsa" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2022:1716" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2021:0637" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2SAF67KDGSOHLVFTRDOHNEAFDRSSYIWA" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APF364QJ2IYLPDNVFBOEJ24QP2WLVLJP" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QY4PJWTYSOV7ZEYZVMYIF6XRU73CY6O7" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2SAF67KDGSOHLVFTRDOHNEAFDRSSYIWA" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APF364QJ2IYLPDNVFBOEJ24QP2WLVLJP" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QY4PJWTYSOV7ZEYZVMYIF6XRU73CY6O7" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:5634" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "type": "CVSS_V3" }, { "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "type": "CVSS_V4" } ], "summary": "Timing attacks in python-rsa" }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.